skills-cli-sync
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches agent definitions and type definitions from the official vercel-labs GitHub repository. These resources are from a trusted organization and are used for routine configuration syncing.
- [COMMAND_EXECUTION]: Uses common command-line utilities such as curl, grep, node, pnpm, and npx for data retrieval, parsing, and performing project validation gates.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external source code from the vercel-labs/skills repository to update local constants. Ingestion Point: curl downloads to /tmp/agents.ts. Boundary Markers: None. Capability Inventory: Regex extraction (grep), local file editing (src/shared/constants.ts), and running a local drift-check script (reconcile-agents.mjs). Sanitization: None. The risk is minimized by the technical nature of the sync task and the trusted status of the upstream repository.
Audit Metadata