openalgo-chart-setup
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'openalgo-charts' library from the npm registry as part of its setup process. This dependency is central to the skill's purpose and originates from the vendor.
- [COMMAND_EXECUTION]: The skill uses shell commands to inspect the local environment and verify the resulting setup. It executes 'cat' and 'rg' on 'package.json' to detect the project's framework, uses 'node' to check library versions, and runs 'npm install', 'npx tsc', and 'npm run build' for verification.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files which influences how the AI agent generates code and executes commands. Ingestion points include 'package.json' content read via shell commands. There are no explicit boundary markers to prevent the agent from being influenced by malicious content within these project files. The skill possesses 'Bash', 'Write', and 'Edit' capabilities which could be targeted by such an injection, although it currently uses specific regex patterns to limit framework identification.
Audit Metadata