skill-repo
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: Several validation and utility scripts, including
validate-skill.sh,sync-plugin-manifest.sh,validate-evals.sh, andmigrate-licensing.sh, execute hardcoded Python logic via thepython3 <<'PYEOF'pattern. This is used for advanced data processing tasks such as JSON manipulation and complex regex validation that exceed standard shell capabilities. - [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to perform repository management operations. As evidenced in thescripts/directory, these actions include usinggitfor version control,ghfor GitHub integration, andglabfor GitLab workflows. These commands are necessary for the skill's intended purpose of automating repository maintenance and releases. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external repository files, including
SKILL.mdmarkdown andevals.jsonstructured data, through its validation scripts (scripts/validate-skill.shandscripts/validate-evals.sh). These scripts perform structural audits and regex-based checks on the ingested data to ensure compliance with repository standards. - [EXTERNAL_DOWNLOADS]: The documentation references external resources from trusted domains. For example,
references/validation-checklist.mdprovides an example command for downloading a scanner from theNousResearch/hermes-agentGitHub repository. Additionally, CI validation prompts (SR-34 and SR-38) suggest fetching configuration or guidelines from the skill's own official repository on GitHub.
Audit Metadata