find-examples
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill uses the GitHub CLI to retrieve official code examples from PlayCanvas repositories (
playcanvas/engine,playcanvas/web-components). These are trusted vendor resources intended for providing version-matched implementation guidance. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and adapts external code content. While this represents a potential surface for indirect prompt injection, the risk is negligible as the data source is the official repository of the skill's author.
- Ingestion points: File content retrieved via
gh apicalls inSKILL.md. - Boundary markers: No specific delimiters are used to wrap the fetched code or warn against instructions within it.
- Capability inventory: The skill utilizes
gh,ls, andnodeto interact with the environment and fetch data. - Sanitization: No filtering or sanitization is applied to the retrieved code before the agent processes it.
- [DYNAMIC_EXECUTION]: Employs
node -pto execute a small script for parsing version metadata from a localpackage.json. This is a routine and safe practice for identifying installed package versions.
Audit Metadata