hap-cli-app-editor
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the
hapCLI tool to perform fine-grained operations on application metadata. It includes safety checks such as requiring the-yorconfirm: trueflags for destructive operations like deletions. - [INDIRECT_PROMPT_INJECTION]: The skill manages application features like AI chatbot prompts (
--prompt) and webhooks (hap workflow node save-webhook). These are documented as standard configuration vectors for the HAP platform. The skill provides clear instructions to use existing structures and read-modify-write patterns, which mitigates accidental misconfiguration. - [SAFE]: The skill documentation is thorough and relies on local CLI execution and schema validation. No signs of data exfiltration, obfuscation, hardcoded credentials, or unauthorized remote code execution were detected. References to standard JSON schema URLs and placeholder examples are benign.
Audit Metadata