skills/luongnv89/skills/name-checker/Gen Agent Trust Hub

name-checker

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to maintain repository state, specifically git fetch, git pull --rebase, and git stash in the SKILL.md file. These commands are part of a standard synchronization workflow for developer-oriented AI agents.
  • [EXTERNAL_DOWNLOADS]: The agent interacts with well-known registries such as npm, PyPI, and Homebrew via their public APIs. These downloads are used to check for package namespace collisions and are performed against established, trusted technological services.
  • [PROMPT_INJECTION]: The skill possesses a surface area for indirect prompt injection because it ingests and processes text data from external websites (social profiles, registry descriptions, and trademark results).
  • Ingestion points: Data retrieved via WebSearch and WebFetch from social media platforms, package registries, and trademark databases, as well as the local prd.md file.
  • Boundary markers: Absent; external data is interpolated into the context of sub-agents without the use of explicit delimiters or instructions to ignore embedded commands.
  • Capability inventory: Includes the ability to execute git shell commands and perform subsequent network operations through web search and fetch tools.
  • Sanitization: Names are normalized into a slug format (lowercase with hyphens), but there is no specific sanitization or filtering applied to the descriptive text content retrieved from external sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 04:18 AM
Security Audit — agent-trust-hub — name-checker