quiz-me

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local shell utilities (git, sed, awk, sha256sum) to identify repositories and calculate change metrics for its internal logic. These subprocess calls are used for project-aware configuration and do not involve untrusted input execution.
  • [DATA_EXFILTRATION]: The tool accesses repository metadata and code diffs to generate its reports. The results are stored locally in the environment's persistent plugin data directory. No network operations were found that would transmit this data to external domains.
  • [PROMPT_INJECTION]: The skill processes repository history to create summaries. 1. Ingestion points: git diff and git history (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Local file writing to ${CLAUDE_PLUGIN_DATA} (SKILL.md). 4. Sanitization: Instructions are provided to distill context and intuition without including secrets or tokens. This surface is evaluated as safe as it is central to the tool's intended utility.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 07:56 PM
Security Audit — agent-trust-hub — quiz-me