vendor-sync
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Synchronization of External Resources: The skill facilitates the download of code from repositories hosted by the authoring organization. This is a standard workflow for maintaining project dependencies and is used here to update internal tooling components.
- System Command Execution: The instructions involve running various shell commands for environment setup and verification, such as
uv runandnpm install. These are used within the context of project maintenance and synchronization. - Verification of Vendored Content: A security consideration for skills that ingest external data is the potential for unexpected instructions. This skill mitigates this by including steps to verify synchronized content against a lockfile (
skills-lock.json) and using automated verification tools. - Sandbox Isolation: The skill documentation notes that certain components are designed to run in a network-isolated environment without access to sensitive credentials, which reflects an established security boundary.
Audit Metadata