scrolls-unhide
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes bundled shell (
unhide.sh) and PowerShell (unhide.ps1) scripts to automate the renaming of project directories and the updating of file content. These scripts are self-contained and operate on local project files within the user's current working directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes the contents of project documentation files like
STARTER.mdandCLAUDE.mdto update path references. The scripts utilize literal string replacement logic (using escaped regex in Bash or the.Replace()method in PowerShell), which prevents content within those files from being interpreted as instructions or commands. - [DATA_EXPOSURE]: The skill performs file system modifications to maintain consistency after renaming project folders. Analysis confirms that the operations are restricted to the project structure and do not involve network transmission or access to sensitive system directories or credentials.
Audit Metadata