vvvv-node-libraries
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and templates for vvvv gamma development without any malicious intent or hidden code execution. All external resources originate from the primary platform vendor or the skill author.
- [COMMAND_EXECUTION]: The instructions include standard CLI commands for vvvv gamma configuration (e.g.,
--package-repositories,--editable-packages) and .NET development (dotnet restore). These commands are essential for the development workflows described and are used within their intended context. - [EXTERNAL_DOWNLOADS]: The skill references official vvvv GitHub repositories (e.g.,
vvvv/VL.StandardLibs,vvvv/VL.IO.MQTT) and public package registries like NuGet.org. These references are for legitimate dependencies and documentation, originating from trusted services related to the skill's purpose. - [REMOTE_CODE_EXECUTION]: A GitHub Actions workflow template is provided in
publishing.md. It utilizes a specific action from the vvvv organization (vvvv/PublishVLNuget) for publishing packages to NuGet. This is a standard automation practice and correctly utilizes GitHub Secrets for sensitive API keys. - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface where user requirements (ingestion points in
SKILL.md) are translated into project structures. While it lacks explicit boundary markers or sanitization logic for these inputs, its capability inventory is restricted to standard development tools (CLI commands, .NET builds) and it does not exhibit patterns of adversarial instruction following.
Audit Metadata