skills/pachca/openapi/pachca-search/Gen Agent Trust Hub

pachca-search

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and executes the @pachca/cli package from the NPM registry using the npx utility.
  • [COMMAND_EXECUTION]: Shell commands are used to invoke the pachca CLI tool for searching messages, chats, and users, as well as managing authentication status.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content retrieved from external Pachca search results, which could contain embedded instructions intended to influence the agent.
  • Ingestion points: Data returned from pachca search list-messages, pachca search list-chats, and pachca search list-users commands.
  • Boundary markers: None present in the instructions to delimit external content or warn the agent about embedded instructions.
  • Capability inventory: Ability to execute shell commands via Bash(npx:*) and Bash(pachca:*) tools.
  • Sanitization: No explicit sanitization or validation of the search result content is described.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 09:02 PM