ai
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [Command Execution Capability]: The skill documents the use of the Model Context Protocol (MCP) to execute local command-line tools. For example, it demonstrates running a filesystem server via
npx. This provides the agent with the ability to interact with the local environment to perform specialized tasks. - [External Package Management]: The instructions involve installing the
vercel-ai-sdkpackage and downloading tools vianpxat runtime. These are standard procedures for setting up and extending the functionality of the agent development environment. - [Credential Management]: The skill encourages the use of environment variables for API keys (e.g.,
ANTHROPIC_API_KEY,OPENAI_API_KEY). This is a recommended security practice to avoid the exposure of sensitive credentials in source code. - [Indirect Prompt Injection Surface]: As a framework for building agents, the skill naturally processes untrusted data from user messages and external tool outputs. This creates a surface for indirect instructions, which is a standard consideration for developers when implementing validation and safety boundaries in their agent logic.
Audit Metadata