skills/paradevai/paradev/feedback/Gen Agent Trust Hub

feedback

Pass

Audited by Gen Agent Trust Hub on Oct 20, 2026

Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DATA_EXFILTRATION]: The skill is designed to collect diagnostic information such as environment details, user identity via superset auth whoami, and system logs to assist Superset engineers with debugging.
  • The instructions explicitly require the agent to warn users that logs or screenshots may contain private information and mandate obtaining user consent before including such data in a report.
  • Collected data is only sent to vendor-controlled destinations, specifically the support@superset.sh email address or the official superset-sh/superset GitHub repository.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied feedback which is subsequently used to generate report drafts and search documentation.
  • Ingestion points: User-provided text describing bugs, features, or general feedback.
  • Boundary markers: The instructions do not specify natural language delimiters for the LLM, but they define strict technical boundaries for tool interactions.
  • Capability inventory: The skill uses Bash to interact with the superset and gh (GitHub) CLI tools.
  • Sanitization: To prevent the user-supplied text from triggering unintended shell commands, the skill specifically instructs the agent to use heredocs (<<'EOF') or temporary files when passing data to the superset or gh commands.
  • [EXTERNAL_DOWNLOADS]: The skill fetches content from external sources to provide relevant documentation and version checks.
  • It retrieves documentation from docs.superset.sh and checks for software updates by reading version metadata from the official superset-sh/superset GitHub repository.
  • These operations are limited to the vendor's own infrastructure and are used for intended functional purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 20, 2026, 06:41 AM