oss-maintainer-sustainability
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or attack vectors were detected in the skill instructions or referenced files.
- [DATA_EXFILTRATION]: The skill provides guidance on managing credentials (registry tokens, forge ownership) but does so by encouraging security best practices such as enabling 2FA, using CI-based trusted publishing, and revoking personal tokens before a project is archived.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read repository metadata (READMEs, issue counts, contributor graphs) to populate a 'ledger'. While this represents an ingestion point for untrusted data, the skill uses this information purely for generating a static sustainability plan and does not execute content found in these external sources. The risk is assessed as low/safe.
- [REMOTE_CODE_EXECUTION]: There are no instances of remote code execution or suspicious external downloads. References to other skills (e.g., 'samber/developer-relations-skills@oss-governance') are internal platform references to the author's other tools.
- [OBFUSCATION]: No obfuscation techniques, hidden URLs, or encoded commands were found in the provided files.
- [PRIVILEGE_ESCALATION]: The skill explicitly warns against granting excessive permissions prematurely, citing the 'xz-utils' and 'event-stream' incidents as evidence that unvetted handovers are a security risk.
Audit Metadata