pm-selfcheck

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Bash scripts to perform local file system operations, such as locating the project root (PKG_ROOT), checking file line counts, and searching for metadata tags using grep and find. These operations are consistent with its stated purpose of auditing skill health.
  • [EXTERNAL_DOWNLOADS]: The skill checks for the presence of an external tool (anysearch) in several standard local paths. If missing, it provides a neutral recommendation to install it from a GitHub repository belonging to the skill's author (konglong87), which aligns with the developer's ecosystem.
  • [DATA_EXFILTRATION]: The script reads local configuration files (like .claude/settings.json) specifically to detect if certain search providers (e.g., Exa MCP) are configured. It does not transmit this data externally; it only reports the status back to the user in the generated report.
  • [PROMPT_INJECTION]: The skill contains a 'STOP' section and a 'Verification Checklist' intended to ensure the agent follows the auditing process accurately and bases its conclusions on data rather than assumptions. These are standard behavioral guardrails for this type of task and do not attempt to bypass safety filters.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 06:19 AM
Security Audit — agent-trust-hub — pm-selfcheck