sentisense
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill encourages installation of official vendor packages including the 'sentisense' library for Python and Node.js, and suggests executing the SentiSense CLI via 'npx -y sentisense@0.47.1'. These resources are hosted on official vendor channels (GitHub 'SentiSenseApp', NPM, and PyPI).
- [COMMAND_EXECUTION]: The documentation provides examples for using the SentiSense CLI ('npx sentisense') to retrieve data and manage authentication. The 'auth' command is designed to store the API key locally in the user's home directory ('~/.config/sentisense/') with restricted file permissions (600), which is a standard and safe practice for CLI tools.
- [INDIRECT_PROMPT_INJECTION]: The skill processes news headlines, social media mentions, and AI-generated summaries which are ingested from external sources. While this constitutes an indirect prompt injection surface, the risk is assessed as safe because the API returns analyzed data and curated insights rather than raw, untrusted executable code, and the skill does not grant the agent capabilities to perform destructive actions based on this input.
Audit Metadata