skills/lulu-eva/eva-skill/eva-shared/Gen Agent Trust Hub

eva-shared

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The AI agent is instructed to run local Python scripts (e.g., eva_asset_validate.py, eva_memory_save.py, eva_data_export.py) provided within the skill package for validating assets, organizing memories, and exporting project data. These scripts are central to the ecosystem's functionality and are executed via the local python3 interpreter.
  • [SAFE]: The skill demonstrates strong security practices, including the use of restricted file permissions (0600), project-root boundary checks to prevent path traversal, and explicit user confirmation flows for sensitive data operations such as exporting backups.
  • [SAFE]: The skill includes dedicated instructions in its security reference files to handle untrusted external data as passive information, explicitly requiring the agent to ignore any command-like content embedded within processed materials to mitigate indirect prompt injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 08:54 AM
Security Audit — agent-trust-hub — eva-shared