lov-electron-delta-updater
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill includes a local validation utility (
scripts/validate_skill.py) that performs hygiene and metadata checks on the skill's source files. The script uses secure practices such as safe YAML loading and verifies the absence of hardcoded private absolute paths. - [SAFE]: The technical workflow for update verification follows security best practices, such as restricting local update feed proxies to the loopback interface (
127.0.0.1) and requiring explicit verification of artifact signatures, hashes, and architectures before processing. - [INDIRECT_PROMPT_INJECTION]: The skill instructions define an attack surface for indirect prompt injection by processing external project data, such as appcast XML feeds and release binaries. This is mitigated by instructions to verify signatures and file integrity before ingestion, and by using bounded network requests with cancellation signals.
Audit Metadata