skills/somtougeh/dotfiles/agentation/Gen Agent Trust Hub

agentation

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the agentation package from the npm registry to provide the toolbar component.
  • [COMMAND_EXECUTION]: The setup process involves executing several commands to manage the environment and tools:
  • npm install agentation for package installation.
  • claude mcp add agentation -- npx agentation-mcp server to register the Model Context Protocol server for persistent tool access.
  • npx agentation-mcp doctor to perform a diagnostic check on the setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates syncing annotations from a visual web toolbar into the agent's context, which introduces a potential attack surface.
  • Ingestion points: Annotations are collected from the web interface and processed by the agent through the agentation-mcp server (SKILL.md).
  • Boundary markers: The instructions do not define specific delimiters to isolate the synced data from the agent's primary instructions.
  • Capability inventory: The skill allows the agent to modify project layout files (layout.tsx, _app.tsx) and execute shell commands for setup and verification (SKILL.md).
  • Sanitization: No evidence of sanitization or filtering for the external annotation content is provided in the skill documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 04:37 AM