feedback
Warn
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill's script reads sensitive session history logs and arbitrary user-uploaded files from the filesystem and transmits them to a remote API. While intended for feedback, this pattern constitutes data exfiltration of private conversation details.\n- [COMMAND_EXECUTION]: The skill uses the shell to execute a Node.js script with arguments derived from user input. This creates a surface for command injection if the agent fails to properly escape the feedback text before execution.\n- [CREDENTIALS_UNSAFE]: The script contains a hardcoded fallback value 'gw-secret-token' for an internal API authentication header.
Audit Metadata