superset
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documents an installation workflow using
curl -fsSL https://superset.sh/cli/install.sh | sh. This is the developer's official installation method and originates from a domain owned by the skill author (superset-sh).- [COMMAND_EXECUTION]: ThesupersetCLI allows users and agents to execute shell commands within workspaces using flags such as--command "...". This functionality is a core, documented feature of the tool designed for automation tasks.- [PROMPT_INJECTION]: The skill processes untrusted input from external sources such as project lists, task titles, and pull request metadata. This creates an entry point for potential indirect prompt injection, which is an inherent risk of the data-processing capabilities for this type of orchestration tool.
Audit Metadata