shiny-obd
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent on how to ingest and process data from vehicle ECUs, including VINs, ECU names, and Diagnostic Trouble Codes (DTCs). These data points are external inputs that could theoretically contain malicious instructions if the vehicle hardware is compromised.
- Ingestion points: Vehicle data read via
connection.Executefor commands likeVinCommand,EcuNameCommand, andDtcReadCommand(SKILL.md). - Boundary markers: The instructions do not specify delimiter-based boundary markers for interpreting these strings.
- Capability inventory: The skill uses network (WiFi TCP), Bluetooth LE, and Serial communication capabilities.
- Sanitization: The library provides
VinNumber.Normalizeto validate VIN structure (length and character set), though it does not explicitly filter for natural language instructions. - [EXTERNAL_DOWNLOADS]: The skill references official project repositories and well-known services.
- Evidence: It points to the
shinyorgorganization's GitHub repository for the library source and references the NHTSA vPIC registry for VIN decoding, which is a standard industry service. - [COMMAND_EXECUTION]: The skill provides documentation for necessary system configuration on Linux environments, such as adding users to the
dialoutgroup and settingudevrules to ignore ModemManager interference. - Evidence: These are informative instructions for environment setup required for hardware serial communication and are not presented as automated agent execution steps.
Audit Metadata