why-hire-me-update
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches version metadata from the GitHub API (
api.github.com) to check for updates for the author'swhy-hire-merepository. This is a standard update-checking mechanism targeting a well-known service. - [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Node.js script for version comparison and use the
npx skills updateutility to apply updates. The instructions explicitly require the agent to obtain user approval before executing the update command. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests external data (version tags) from the GitHub API.
- Ingestion points: The
tag_namefield from the GitHub release API is processed inscripts/check-version.mjs. - Boundary markers: The
SKILL.mdfile mandates that the agent must explain the update process and wait for user approval before taking action. - Capability inventory: The skill can execute the
npx skills updatecommand to modify the local environment. - Sanitization: The
check-version.mjsscript utilizes a regular expression (/^v?(\d+)\.(\d+)\.(\d+)$/) to validate that the ingested tag follows a standard semantic versioning format before it is used.
Audit Metadata