skills/luongnv89/asm/find-me-skills/Gen Agent Trust Hub

find-me-skills

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the asm CLI to interact with the local environment and a remote catalog. Specific commands include command -v asm for prerequisite checking, asm search for discovery, and asm bundle show for manifest validation. It also executes date -u +%Y-%m-%dT%H:%M:%S.000Z to generate ISO-8601 timestamps for the bundle metadata.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data retrieved from an external, live catalog which is not under the immediate control of the skill itself.
  • Ingestion points: In SKILL.md (Step 3) and references/catalog-discovery.md, the agent is instructed to read JSON output from asm search, specifically evaluating the description and installCommand fields of candidate skills.
  • Boundary markers: No explicit boundary markers or instructions to ignore instructions embedded within catalog descriptions are provided.
  • Capability inventory: The skill possesses the capability to execute shell commands (asm), write JSON files to the filesystem, and provide the user with a command to install the discovered remote code.
  • Sanitization: There is no evidence of sanitization or filtering of the text content retrieved from the catalog before it is used to generate the sequenced plan for the user.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations via the asm tool to fetch catalog data and facilitates the installation of remote skills using the asm bundle install command.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 05:13 AM