charmed-bubbles

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references Go modules from charm.land/bubbles/v2 and provides links to example programs in the author's GitHub repository (github.com/tpscloud/charmedimsure). These resources are used to integrate the component library into Go projects.
  • [COMMAND_EXECUTION]: The instructions direct the user to run standard Go development commands, specifically go build ./... and go vet ./..., to validate and compile terminal applications.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents components designed to ingest data from the terminal environment and user input, which constitutes a potential attack surface if the application processes untrusted content without proper sanitization.
  • Ingestion points: textinput, textarea, and filepicker components as described in references/text-input.md and references/filepicker-tree.md.
  • Boundary markers: Not included in the provided documentation examples.
  • Capability inventory: Go toolchain commands (go build, go vet) mentioned in SKILL.md.
  • Sanitization: Not explicitly detailed within the component documentation snippets.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 12:20 PM