siyu-save

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local system command via python3 -c to generate standardized ISO 8601 timestamps for file organization purposes.
  • [DATA_EXFILTRATION]: While the skill interacts with sensitive data (PII, authentication tokens, and API keys), it implements a high-standard privacy workflow. It performs automated scanning and masking of sensitive values and requires explicit user authorization before saving files. File operations are restricted to the ~/.siyu/clients/ directory with explicit checks against path traversal (e.g., blocking .. sequences).
  • [PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by processing conversation data into archives. It mitigates this risk through a mandatory human-in-the-loop verification step, schema-based structure enforcement, and content sanitization prior to file creation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 02:02 AM
Security Audit — agent-trust-hub — siyu-save