skills/vercel-labs/py-ai/ai/Gen Agent Trust Hub

ai

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [Command Execution Capability]: The skill documents the use of the Model Context Protocol (MCP) to execute local command-line tools. For example, it demonstrates running a filesystem server via npx. This provides the agent with the ability to interact with the local environment to perform specialized tasks.
  • [External Package Management]: The instructions involve installing the vercel-ai-sdk package and downloading tools via npx at runtime. These are standard procedures for setting up and extending the functionality of the agent development environment.
  • [Credential Management]: The skill encourages the use of environment variables for API keys (e.g., ANTHROPIC_API_KEY, OPENAI_API_KEY). This is a recommended security practice to avoid the exposure of sensitive credentials in source code.
  • [Indirect Prompt Injection Surface]: As a framework for building agents, the skill naturally processes untrusted data from user messages and external tool outputs. This creates a surface for indirect instructions, which is a standard consideration for developers when implementing validation and safety boundaries in their agent logic.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 05:51 AM
Security Audit — agent-trust-hub — ai