rabbit-readme-improver

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes its own Python script scripts/readme_check.py as part of the README auditing workflow. The test suite also utilizes subprocess.run to invoke the checker script for regression testing in tests/helpers.py and various test files.
  • [DYNAMIC_EXECUTION]: The skill performs dynamic module loading. The checker script scripts/readme_check.py uses importlib.util to load a sister script scan.py from the rabbit-writes skill directory. Additionally, the custom test runner tests/run.py uses __import__ to dynamically load test files for execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes README.md files as untrusted data (Ingestion points: project documentation). The skill has capabilities for local file reading and script execution. This attack surface is addressed by a safety scanning band (Sanitization: injection module scanning) designed to detect concealed instructions or prompt injections within the analyzed content.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 10:29 AM
Security Audit — agent-trust-hub — rabbit-readme-improver