pinyin
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions fetch binary releases from the author's GitHub repository (
github.com/mnhkahn/cyeam-cli). - [COMMAND_EXECUTION]: The installation process involves shell commands to extract the binary, modify its permissions with
chmod, and execute it. - [PRIVILEGE_ESCALATION]: The installation guide suggests using
sudoto move the binary into/usr/local/bin/for global system access, which is a standard procedure for installing CLI tools. - [REMOTE_CODE_EXECUTION]: The skill provides commands to download and immediately extract/execute binaries from the author's GitHub repository via piped shell commands.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Chinese text through a CLI tool to generate Pinyin outputs and PDFs.
- Ingestion points: User-supplied strings passed as arguments to
cyeam pinyinandcyeam pinyin sheet(found inSKILL.md). - Boundary markers: None provided in the command templates to separate untrusted text from command arguments.
- Capability inventory: The skill executes the
cyeamCLI tool, which handles file generation (PDF) and Pinyin processing. - Sanitization: No specific input sanitization or escaping mechanisms are described for the text input.
Audit Metadata