lov-dev-research
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill manages user preferences and brand profiles using the
scripts/profile_store.pyutility. This script implements security best practices by explicitly filtering out sensitive fields such as tokens, passwords, and API keys. It also uses atomic writes and restricts file permissions to the current user (0o600) to prevent local data exposure. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of software requirements. It mitigates risk by defining clear execution boundaries, separating read-only analysis from modification tasks, and explicitly instructing the agent not to bypass protections or terminate user processes without authorization.
- [COMMAND_EXECUTION]: The workflow involves retrieving documentation and repository information to inform technology choices. This is consistent with the skill's stated purpose, and the instructions explicitly prohibit the skill from performing automated installations, procurement, or deployments.
- [SAFE]: The provided validation and configuration scripts are transparent, well-documented, and do not perform any hidden network operations or dynamic code execution.
Audit Metadata