pocket-education
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill frequently invokes 'npx -y pocketto-pi' and 'npx -y pocketto-pi@latest' to download and execute a CLI tool from the npm registry. This is a vendor-owned resource used for initializing learner profiles, setting skill levels, and managing learning journals. While it is a primary functional component, it constitutes remote code execution from a public registry.- [COMMAND_EXECUTION]: The skill is instructed to run project-specific build and test commands found in repository memory files (like CLAUDE.md or AGENTS.md), as well as git operations such as 'git status', 'git diff', and 'git rev-parse' to analyze the learner's work.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content by reading existing repository files and the learner's uncommitted diffs to provide guidance and reviews. This creates a potential vector for instructions embedded in code to influence the agent's mentoring logic.
- Ingestion points: Learner's git diffs (staged and unstaged), untracked files identified by 'git status', and project files referenced during investigation or review.
- Boundary markers: The skill does not define specific delimiters or security warnings to isolate untrusted code from its own instructional logic.
- Capability inventory: The skill can execute shell commands for testing, analysis, and CLI interactions, but is strictly gate-restricted from creating, editing, or deleting application code, or performing git commits/pushes.
- Sanitization: No explicit sanitization or filtering of repository-provided content is performed before analysis.
Audit Metadata