lov-five
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's README recommends installation via
npx, and the source validation utilityscripts/validate_skill.pydepends on thePyYAMLlibrary, which is typically fetched from a package registry.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data and user inputs to trigger its functional modes. It defines execution boundaries inSKILL.mdand incorporates manual confirmation flags in its persistence scripts to maintain user control and prevent unintended modifications.\n- [DATA_EXFILTRATION]: The skill manages local persistent state using aprofile.jsonfile in the user's config directory. It includes a security filter that specifically prevents the storage of sensitive fields such as 'token', 'secret', or 'api_key'.
Audit Metadata