lov-project-port
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts project names or directory paths as input to generate port numbers and provides instructions for the agent to update local configuration files. * Ingestion points: Project names provided via user input or inferred from the current working directory in scripts/hashport.sh. * Boundary markers: Absent. The skill instructions do not specify delimiters or safety warnings to ignore instructions that could be embedded in the project names. * Capability inventory: The skill has the capability to execute a local bash script (scripts/hashport.sh) and modify project files such as .env, package.json, and vite.config.ts. * Sanitization: The project name is transformed into a number through a hashing algorithm, which effectively sanitizes the input for its primary use as a port value.
- [COMMAND_EXECUTION]: The skill uses a bash script to handle port logic and check for process occupancy. * The script scripts/hashport.sh executes the lsof command to check if a port is currently in use. This is a standard system utility for development and port management, used appropriately within the skill's context.
Audit Metadata