follower-item-built-from-shared-payload
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides software engineering guidelines for synchronizing media playback sessions. It focuses on preventing common bugs related to media rendition inference and network blocking in client-side collectors. The instructions advocate for building items directly from shared payloads rather than re-resolving them locally to ensure consistency across clients.
- [COMMAND_EXECUTION]: The skill includes shell commands using
grepand aforloop to search Kotlin source files for specific patterns (e.g., rendition inference, media item builders, and network suspension points). These commands are intended for static analysis of local source code and do not involve remote data, unauthorized network access, or privilege escalation. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill documentation explicitly warns against sharing resolved URLs that might contain credentials or expire, demonstrating a security-conscious approach to session payload design. It identifies the risk that a resolved URL is per-client and should not be distributed through shared session payloads.
Audit Metadata