gimble-release

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill utilizes vp dlx to download and install agent skills directly from the tylergannon/gimble GitHub repository. It also performs remote installation of the application's Go binary using the go install command targeting the author's repository.
  • [COMMAND_EXECUTION]: The instructions direct the agent to execute various shell commands for the build and deployment process, including just build, go install, and vp dlx for environmental setup.
  • [PERSISTENCE]: The skill automates the installation of files into the persistent agent environment at ~/.agents/skills/ and installs the gimble binary into the user's executable path, which maintains its state across system sessions.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for reading and processing local documentation and requirement files, which serves as a potential surface for indirect prompt injection.
  • Ingestion points: Reads AGENTS.md, docs/definition-of-done.md, and local requirement files in the worktree.
  • Boundary markers: Absent; the instructions do not specify delimiters or warnings for these inputs.
  • Capability inventory: Includes command execution via just and go, file system manipulation via installation commands, and network access for skill retrieval.
  • Sanitization: Absent; the agent is instructed to use outcomes and facts derived from these files to guide implementation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 11:38 PM