skills/qwibitai/nanoclaw/add-gchat/Gen Agent Trust Hub

add-gchat

Pass

Audited by Gen Agent Trust Hub on Apr 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches code and dependencies from external sources as part of the installation process.
  • Fetches source files from a remote Git branch (origin/channels) using git fetch and git show.
  • Installs the @chat-adapter/gchat@4.26.0 package from the npm registry.
  • [COMMAND_EXECUTION]: The skill requires the execution of several shell commands to configure the environment and build the application.
  • Runs pnpm install and pnpm run build during setup.
  • Uses file operations (mkdir, cp) to sync environment configurations to a data directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill enables a communication channel that ingests data from Google Chat spaces, creating a surface for indirect prompt injection where external messages could influence agent behavior.
  • Ingestion points: Incoming messages and mentions from Google Chat spaces.
  • Boundary markers: None explicitly mentioned; the skill relies on the underlying framework's handling of message data.
  • Capability inventory: Enables the agent to respond to messages and potentially interact with framework tools via the Google Chat interface.
  • Sanitization: The instructions do not specify any unique sanitization steps for the incoming message stream beyond standard platform behaviors.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 26, 2026, 09:50 PM