lov-version-management
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill incorporates a local configuration utility (
scripts/profile_store.py) that manages user preferences and metadata. It includes security controls that filter out sensitive fields such as tokens and passwords from being persisted and uses restricted file permissions (0o600) for stored data. - [PERSISTENCE]: The skill utilizes a local directory (e.g.,
~/.config/agent-skills/) to maintain a profile JSON file. This mechanism is intended for legitimate storage of user defaults and tool-specific records across sessions. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the local project environment, specifically
package.jsonfiles and Git differences. TheSKILL.mdfile defines explicit execution boundaries that prevent the agent from treating this data as instruction overrides and mandates human confirmation for any version releases or code changes, mitigating the risk of accidental or malicious command execution.
Audit Metadata