wk-cloudsmith
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill defines a workflow that ingests data from external Cloudsmith API responses to extract package identifiers.
- Ingestion points:
SKILL.md(via API responses stored inresponse.json). - Boundary markers: Absent in the provided code snippets.
- Capability inventory: Network access via
curland shell execution for script logic. - Sanitization: The parsed data is used directly in subsequent command arguments without explicit validation or escaping.
- [COMMAND_EXECUTION]: Provides bash command snippets using
curlandjqto facilitate package management tasks on a remote registry. - [EXTERNAL_DOWNLOADS]: Instructions describe patterns for downloading binaries from Cloudsmith's content delivery network endpoints.
Audit Metadata