version-aware-recommendations
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust framework for accuracy and safety by requiring the agent to verify all software recommendations against live, external sources. This prevents common failure modes like version hallucination or recommending deprecated features.
- [EXTERNAL_DOWNLOADS]: The instructions identify authoritative, well-known software registries (such as PyPI, npm, crates.io, and Docker Hub) as the primary sources for version data. These are established industry standards for software distribution.
- [COMMAND_EXECUTION]: The skill mentions common package managers (apt, pip, npm, etc.) solely in the context of the agent's task scope (recommending and deploying software) and does not contain hidden or malicious shell commands.
- [INDIRECT_PROMPT_INJECTION]: The skill provides procedures for ingesting external documentation and search results. While this introduces a potential attack surface for indirect injection, the skill mitigates this by instructing the agent to use official documentation sources and prioritize stable releases, which are less likely to contain adversarial content than unverified third-party blogs or forums.
Audit Metadata