package-adoption
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata from external registries (npm and GitHub) through the registry tool. This content is then processed within a shell environment.
- Ingestion points: Metadata retrieved via registry npm and registry github <owner/repo> (SKILL.md).
- Boundary markers: The instructions do not specify any delimiters or warnings to ignore potential instructions embedded in the external metadata.
- Capability inventory: The skill utilizes the hedwigai MCP's bash tool, which provides shell access for executing registry and jq commands.
- Sanitization: There are no explicit instructions for sanitizing or escaping the data fetched from external sources before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill relies on executing shell commands within a bash environment to perform its core functions. It uses the registry program to fetch data and jq for JSON processing.
Audit Metadata