truto
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes the official installation command for the Truto CLI using a shell pipe (
curl -fsSL https://cli.truto.one/install.sh | bash). While this pattern is flagged by automated scanners, it is the vendor's documented method for installing their command-line tool from their own domain (truto.one). - [EXTERNAL_DOWNLOADS]: The skill documentation references the installation of the
@truto/truto-link-sdkfrom the NPM registry and the Truto CLI binary from the vendor's official infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from various third-party integrations (e.g., CRMs, Ticketing systems) via the Truto Unified API. This represents a potential surface for indirect prompt injection if third-party data contains malicious instructions. The skill encourages best practices by providing architectural guidance for handling this data on the backend.
Audit Metadata