explain-to-me
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to https://here.now to publish HTML content and retrieve site data. It also interacts with GitHub's Gist API via the gh command-line tool.
- [COMMAND_EXECUTION]: The skill executes internal Python scripts to automate publishing tasks. These scripts are invoked with arguments based on user input, such as the topic of the explainer.
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves user-submitted notes from a server using scripts/read_decisions.py.
- Ingestion points: User comments and decision notes are ingested from the here.now API.
- Boundary markers: Missing; retrieved content is printed directly with minimal formatting or delimiters.
- Capability inventory: The skill has the capability to write files, execute scripts, and perform network operations.
- Sanitization: None; external data is presented raw to the agent context.
- [DYNAMIC_EXECUTION]: The script scripts/publish_interactive.py dynamically loads a peer script (publish_explainer.py) using importlib.util. This is done to share logic between scripts while maintaining a stable execution environment.
Audit Metadata