skills/lancetw/skills/bible-bread/Gen Agent Trust Hub

bible-bread

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill extensively uses the Bash tool to execute shell pipes for data processing (e.g., grep | awk | sed | shuf) and to run local Python scripts via uv run. This execution is used for path resolution, scripture retrieval, and environment detection.
  • [EXTERNAL_DOWNLOADS]: The skill initiates the download and installation of the chromium browser using patchright. It also instructs users to install external dependencies via npx skills add from vendor-associated repositories.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Bible APIs (Sefaria, Bible Gateway, FHL) which are then processed into the final devotional output. While the skill has access to Bash and Write tools, it lacks explicit boundary markers or sanitization when interpolating this external scripture content into its prompts, creating a potential surface for indirect injection if a source were compromised.
  • [DYNAMIC_EXECUTION]: Scripts are executed from dynamically resolved filesystem paths within the user's or project's skill directories (e.g., ~/.claude/skills/bible-buddy/). It also attempts to conditionally execute an external conversion script (md_to_html.py) if the corresponding optional skill is detected on the system.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 12:59 PM