find-examples

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill uses the GitHub CLI to retrieve official code examples from PlayCanvas repositories (playcanvas/engine, playcanvas/web-components). These are trusted vendor resources intended for providing version-matched implementation guidance.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and adapts external code content. While this represents a potential surface for indirect prompt injection, the risk is negligible as the data source is the official repository of the skill's author.
  • Ingestion points: File content retrieved via gh api calls in SKILL.md.
  • Boundary markers: No specific delimiters are used to wrap the fetched code or warn against instructions within it.
  • Capability inventory: The skill utilizes gh, ls, and node to interact with the environment and fetch data.
  • Sanitization: No filtering or sanitization is applied to the retrieved code before the agent processes it.
  • [DYNAMIC_EXECUTION]: Employs node -p to execute a small script for parsing version metadata from a local package.json. This is a routine and safe practice for identifying installed package versions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 12:54 AM
Security Audit — agent-trust-hub — find-examples