lov-meta-command
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified in the skill source or scripts.
- [DATA_EXPOSURE]: The skill manages user preferences and brand profile data via
scripts/profile_store.py. This script includes a predefined list of sensitive keywords (such astoken,secret,password,credential,cookie,api_key,apikey) and prevents them from being stored in the durable profile records, reducing the risk of accidental credential exposure. - [DYNAMIC_EXECUTION]: The skill's validation utility
scripts/validate_skill.pyemploysyaml.safe_loadfor parsing YAML files, which is a security best practice that prevents arbitrary code execution during the deserialization of configuration data. - [INDIRECT_PROMPT_INJECTION]: The skill processes natural language input and historical commands to generate new skill definitions, creating a surface for indirect prompt injection. This risk is mitigated by the skill's documented execution boundaries, which separate analysis from execution, and the requirement for direct user confirmation for persistent configuration changes via
scripts/profile_store.py.
Audit Metadata