superset-feedback
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local CLI tools including 'superset' (vendor-specific) and 'gh' (GitHub official CLI) to collect environment metadata and manage issue reporting.
- [DATA_EXFILTRATION]: Information such as Superset version, OS type, and user identity is collected and transmitted to the vendor (superset-sh) or GitHub. This is appropriate for the skill's purpose, and more sensitive data like log files require explicit user confirmation before attachment.
- [PROMPT_INJECTION]: The skill processes user-supplied feedback into shell commands. It mitigates command injection risks by using quoted heredocs (<<'EOF') for submission bodies, preventing the shell from interpreting the content of the feedback as executable code.
Audit Metadata