skills/whizzzkid/skills/wk-cloudsmith/Gen Agent Trust Hub

wk-cloudsmith

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill defines a workflow that ingests data from external Cloudsmith API responses to extract package identifiers.
  • Ingestion points: SKILL.md (via API responses stored in response.json).
  • Boundary markers: Absent in the provided code snippets.
  • Capability inventory: Network access via curl and shell execution for script logic.
  • Sanitization: The parsed data is used directly in subsequent command arguments without explicit validation or escaping.
  • [COMMAND_EXECUTION]: Provides bash command snippets using curl and jq to facilitate package management tasks on a remote registry.
  • [EXTERNAL_DOWNLOADS]: Instructions describe patterns for downloading binaries from Cloudsmith's content delivery network endpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 09:50 PM
Security Audit — agent-trust-hub — wk-cloudsmith