skills/uxfion/skills/how-we-work/Gen Agent Trust Hub

how-we-work

Pass

Audited by Gen Agent Trust Hub on Nov 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a specialized Python script (hww.py) to manage markdown synchronization within projects. It also provides instructions for standard development tools such as git, ssh, and uv. These tools are used appropriately for project management and experiment tracking.
  • [EXTERNAL_DOWNLOADS]: The documentation includes a reference to the official installation script for the uv tool from astral.sh. Astral is a well-known and reputable technology company, and the download is part of standard environment setup instructions.
  • [DATA_EXFILTRATION]: The skill includes a notification mechanism using the Bark push notification service. This is an optional, user-configured feature for monitoring long-running unattended tasks. Configuration (such as the server URL and device key) is stored in a local user directory, and the transmitted data is limited to task status updates.
  • [PRIVILEGE_ESCALATION]: The instructions for using remote training servers explicitly forbid the use of sudo or system-wide package installations by the agent, directing the agent to provide commands for the human user to execute instead. This follows the principle of least privilege.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied markdown files to extract rules for promotion. The instructions require the agent to judge each entry manually against established criteria, maintaining a human-in-the-loop safety model for documentation changes.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 11, 2026, 04:19 AM