eva-shared
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The AI agent is instructed to run local Python scripts (e.g., eva_asset_validate.py, eva_memory_save.py, eva_data_export.py) provided within the skill package for validating assets, organizing memories, and exporting project data. These scripts are central to the ecosystem's functionality and are executed via the local python3 interpreter.
- [SAFE]: The skill demonstrates strong security practices, including the use of restricted file permissions (0600), project-root boundary checks to prevent path traversal, and explicit user confirmation flows for sensitive data operations such as exporting backups.
- [SAFE]: The skill includes dedicated instructions in its security reference files to handle untrusted external data as passive information, explicitly requiring the agent to ignore any command-like content embedded within processed materials to mitigate indirect prompt injection.
Audit Metadata