charmed-bubbles
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references Go modules from
charm.land/bubbles/v2and provides links to example programs in the author's GitHub repository (github.com/tpscloud/charmedimsure). These resources are used to integrate the component library into Go projects. - [COMMAND_EXECUTION]: The instructions direct the user to run standard Go development commands, specifically
go build ./...andgo vet ./..., to validate and compile terminal applications. - [INDIRECT_PROMPT_INJECTION]: The skill documents components designed to ingest data from the terminal environment and user input, which constitutes a potential attack surface if the application processes untrusted content without proper sanitization.
- Ingestion points:
textinput,textarea, andfilepickercomponents as described inreferences/text-input.mdandreferences/filepicker-tree.md. - Boundary markers: Not included in the provided documentation examples.
- Capability inventory: Go toolchain commands (
go build,go vet) mentioned inSKILL.md. - Sanitization: Not explicitly detailed within the component documentation snippets.
Audit Metadata