Skills
Navigate
skills/lovstudio/skills/lov-fix-by-add-log/Gen Agent Trust Hub

lov-fix-by-add-log

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DATA_EXPOSURE]: The skill utilizes scripts/profile_store.py to read and write user profile information to local directories such as ~/.config/agent-skills/ and ~/.lovstudio/skills/.
  • The script implements a protective filter (SENSITIVE_PARTS) that prevents the persistence of keys containing 'token', 'secret', 'password', 'credential', 'cookie', or 'api_key'.
  • Writes are performed atomically using temporary files to prevent data corruption.
  • [COMMAND_EXECUTION]: The skill provides scripts and instructions for local execution to perform its duties.
  • README.md suggests using npx for installation and python3 scripts/validate_skill.py for local validation.
  • SKILL.md describes using the host's CLI and search capabilities to debug project files.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, specifically software logs and reproduction paths.
  • Ingestion points: Debugging targets including log files, reproduction paths, and existing logs specified in the Workflow section of SKILL.md.
  • Boundary markers: The instructions mandate protecting uncommitted content and respecting user-defined cleanup scopes.
  • Capability inventory: File system access (via profile_store.py), search, and CLI tool invocation described in Execution boundary.
  • Sanitization: Step 2 of the Workflow explicitly requires desensitization of passwords, tokens, and user profile data before logging.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 09:46 AM
Security Audit — agent-trust-hub — lov-fix-by-add-log