tsticker
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
tstickerCLI package viapipx. This tool is a resource provided by the vendor to support the skill's core functionality. - [COMMAND_EXECUTION]: The skill executes various
tstickercommands for initializing, syncing, and pushing sticker packs. It also includes a shell script,scripts/push_sticker.sh, which performs file system operations such as copying files and changing directories using user-supplied arguments. The script employs standard quoting to manage these variables. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests data from external Telegram sticker links when using the
downloadandtracecommands. - Ingestion points: Data is ingested from external URLs provided to the
tsticker downloadandtsticker tracecommands inSKILL.md. - Boundary markers: The skill does not employ explicit boundary markers or delimiters to separate ingested data from agent instructions.
- Capability inventory: The skill has capabilities for file system writes and CLI command execution as demonstrated in
SKILL.mdandscripts/push_sticker.sh. - Sanitization: There is no evidence of sanitization or content filtering for the data retrieved from external sticker links.
Audit Metadata