skills/shinyorg/skills/shiny-obd/Gen Agent Trust Hub

shiny-obd

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent on how to ingest and process data from vehicle ECUs, including VINs, ECU names, and Diagnostic Trouble Codes (DTCs). These data points are external inputs that could theoretically contain malicious instructions if the vehicle hardware is compromised.
  • Ingestion points: Vehicle data read via connection.Execute for commands like VinCommand, EcuNameCommand, and DtcReadCommand (SKILL.md).
  • Boundary markers: The instructions do not specify delimiter-based boundary markers for interpreting these strings.
  • Capability inventory: The skill uses network (WiFi TCP), Bluetooth LE, and Serial communication capabilities.
  • Sanitization: The library provides VinNumber.Normalize to validate VIN structure (length and character set), though it does not explicitly filter for natural language instructions.
  • [EXTERNAL_DOWNLOADS]: The skill references official project repositories and well-known services.
  • Evidence: It points to the shinyorg organization's GitHub repository for the library source and references the NHTSA vPIC registry for VIN decoding, which is a standard industry service.
  • [COMMAND_EXECUTION]: The skill provides documentation for necessary system configuration on Linux environments, such as adding users to the dialout group and setting udev rules to ignore ModemManager interference.
  • Evidence: These are informative instructions for environment setup required for hardware serial communication and are not presented as automated agent execution steps.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 11:41 PM
Security Audit — agent-trust-hub — shiny-obd