vector-embed
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs
ruvector@0.2.25andruvector-onnx-embeddings-wasmfrom the npm registry. These dependencies are consistent with the skill's stated purpose and the author's vendor identity. - [COMMAND_EXECUTION]: Executes bash commands to manage dependencies and generate embeddings, including
npm installandnpx. This is standard behavior for Node.js-based tooling. - [PROMPT_INJECTION]: The skill processes external text data to generate embeddings, which constitutes an indirect prompt injection surface. Ingestion points: Data enters the context through the
Readtool as specified in SKILL.md. Boundary markers: The instructions do not define delimiters or specific safety instructions for handling untrusted file content. Capability inventory: The skill uses thebashtool for processing, creating a risk if input is not properly escaped. Sanitization: No sanitization or validation of the input text is described in the workflow.
Audit Metadata