lov-integrate-lovinsp

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes package manager commands (pnpm, npm) for dependency installation and updates. It also uses curl to query the local development server (127.0.0.1) to verify that the code transform is active. These are standard operations for development environment integration.
  • [EXTERNAL_DOWNLOADS]: Fetches the lovinsp package from the official registry. The package is a known resource associated with the vendor, and its installation is the primary purpose of the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes existing project configuration files and server output to determine its integration path.
  • Ingestion points: Reads package.json, bundler configuration files (e.g., vite.config.ts, webpack.config.js), and local development server HTTP responses.
  • Boundary markers: None explicitly present in the provided instructions for these file operations.
  • Capability inventory: Includes file system modification (write access to configs), dependency management (installation/removal), and local network requests (curl).
  • Sanitization: None; the skill uses search-and-replace patterns to modify configuration files rather than executing the ingested data directly during its analysis phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 12:55 AM
Security Audit — agent-trust-hub — lov-integrate-lovinsp