paw-pa-setup
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Python scripts (
merge-config.py,merge-help-csv.py) and system commands (mkdir,command -v) to prepare the project environment and manage configuration files. - [DATA_EXFILTRATION]: The skill handles sensitive data, including transcription API keys, by storing them in a dedicated local file (
config.user.yaml). This approach isolates secrets from shared project configuration and adheres to secure local storage practices. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests untrusted data from a library inbox and user configuration to generate workspace files. It possesses file-write and subprocess execution capabilities. No explicit sanitization or boundary markers were identified in the instructions.
- [EXTERNAL_DOWNLOADS]: The skill mentions external services like AssemblyAI and vendor resources on
pawbytes.io. It checks for the presence of tools such as pandoc using standard command verification but does not perform automated remote downloads.
Audit Metadata