skills/ruvnet/ruflo/vector-embed/Gen Agent Trust Hub

vector-embed

Pass

Audited by Gen Agent Trust Hub on May 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs ruvector@0.2.25 and ruvector-onnx-embeddings-wasm from the npm registry. These dependencies are consistent with the skill's stated purpose and the author's vendor identity.
  • [COMMAND_EXECUTION]: Executes bash commands to manage dependencies and generate embeddings, including npm install and npx. This is standard behavior for Node.js-based tooling.
  • [PROMPT_INJECTION]: The skill processes external text data to generate embeddings, which constitutes an indirect prompt injection surface. Ingestion points: Data enters the context through the Read tool as specified in SKILL.md. Boundary markers: The instructions do not define delimiters or specific safety instructions for handling untrusted file content. Capability inventory: The skill uses the bash tool for processing, creating a risk if input is not properly escaped. Sanitization: No sanitization or validation of the input text is described in the workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
May 7, 2026, 03:18 PM