skills/stvlynn/skills/tsticker/Gen Agent Trust Hub

tsticker

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the tsticker CLI package via pipx. This tool is a resource provided by the vendor to support the skill's core functionality.
  • [COMMAND_EXECUTION]: The skill executes various tsticker commands for initializing, syncing, and pushing sticker packs. It also includes a shell script, scripts/push_sticker.sh, which performs file system operations such as copying files and changing directories using user-supplied arguments. The script employs standard quoting to manage these variables.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests data from external Telegram sticker links when using the download and trace commands.
  • Ingestion points: Data is ingested from external URLs provided to the tsticker download and tsticker trace commands in SKILL.md.
  • Boundary markers: The skill does not employ explicit boundary markers or delimiters to separate ingested data from agent instructions.
  • Capability inventory: The skill has capabilities for file system writes and CLI command execution as demonstrated in SKILL.md and scripts/push_sticker.sh.
  • Sanitization: There is no evidence of sanitization or content filtering for the data retrieved from external sticker links.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 08:42 AM