parable
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install external tools such as the Cursor CLI via a shell script from cursor.com and research skills via npm. These sources are established technology services.
- [COMMAND_EXECUTION]: The verify subcommand executes shell commands defined in the parable.toml configuration file to run tests and linters. It uses shlex.quote to sanitize user-provided targets, reducing the risk of command injection.
- [COMMAND_EXECUTION]: The claude subcommand executes a local binary specified in the configuration (defaulting to 'claude') using os.execvpe.
- [DATA_EXFILTRATION]: The usage tracking tool reads local authentication tokens for Anthropic, OpenAI, and Cursor to check subscription headroom. These tokens are transmitted only to the respective official vendor API endpoints.
- [PROMPT_INJECTION]: The skill processes untrusted data such as git diffs and task plans. It employs a WORKSPACE_CONTRACT as a boundary marker in plans and uses shlex.quote for sanitizing shell arguments. Capability inventory includes subprocess execution for tests and binary execution for sessions.
Audit Metadata