Skills
Navigate
skills/superset-sh/skills/superset-contribute/Gen Agent Trust Hub

superset-contribute

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill clones the superset-sh/superset repository from GitHub. As this is the official repository belonging to the skill's vendor, this is considered a safe and expected operation.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute development commands including gh repo fork, bun run dev, and a local setup script ./.superset/setup.local.sh. These are standard procedures for project contribution.
  • [PROMPT_INJECTION]: The skill directs the agent to treat files within the cloned repository (CONTRIBUTING.md, DEVELOPMENT.md, AGENTS.md) as authoritative instructions. This creates a surface for indirect prompt injection.
  • Ingestion points: CONTRIBUTING.md, DEVELOPMENT.md, AGENTS.md referenced in SKILL.md.
  • Boundary markers: Absent.
  • Capability inventory: Shell command execution (gh, bun, script execution), file system access.
  • Sanitization: Absent.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 08:38 AM
Security Audit — agent-trust-hub — superset-contribute