project-naming
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The main script
scripts/check-name.mtsinvokes thegh auth tokencommand viaspawnSyncto retrieve the user's GitHub token to facilitate authenticated API requests and avoid rate limiting. - [EXTERNAL_DOWNLOADS]: The skill queries a wide range of well-known services and registries to check project names, including PyPI, npm, crates.io, Homebrew (brew.sh), Docker Hub, Maven Central, Hugging Face, GitHub, arXiv, and Bluesky.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and analyzes data from community-edited platforms like Wiktionary and Urban Dictionary. The ingestion of this external content represents an indirect prompt injection surface, although the skill mitigates this by focusing on specific metadata fields and truncating definitions to limited lengths.
Audit Metadata