use-semantius
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation provides installation commands for the semantius CLI that fetch scripts from the vendor's official GitHub repository (github.com/semantius). This is standard procedure for the tool and aligns with the author's infrastructure.
- [REMOTE_CODE_EXECUTION]: Documents the use of remote installation patterns (curl pipe to bash and Invoke-RestMethod to Invoke-Expression) from the vendor's repository. These are presented as setup instructions for the user or agent environment.
- [COMMAND_EXECUTION]: The skill uses the semantius CLI to interact with the platform's API servers (crud, cube, and utils). It provides structured guidance on parameter passing, bulk operations, and error handling.
- [DYNAMIC_EXECUTION]: Includes local TypeScript utility scripts (lucide-icon-finder.ts, lucide-icon-checker.ts, and vendor-names.ts) intended to be executed with the bun runtime to assist with icon identification and name conversion.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Semantius platform and external CSV files. This represents a potential surface for indirect injection from external inputs, although no specific vulnerabilities were detected.
Audit Metadata