lc-log
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local bash commands to validate log formatting, including running
node site/build-review-plan.js,npm test, and a complexnode -ecommand to verify that user input was correctly parsed into the log file. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a conduit for user-supplied data to enter the system's log files.
- Ingestion points: User-provided session descriptions provided as arguments to the
/lc-logcommand (SKILL.md). - Boundary markers: None identified; user input is directly formatted into the log line.
- Capability inventory:
Bash,Write, andEdittools are available to the skill (SKILL.md). - Sanitization: The skill focuses on formatting structure rather than sanitizing the content of the user-provided notes.
- [EXTERNAL_DOWNLOADS]: The skill contains a reference to another skill hosted on GitHub under the
yennanliuorganization. - [DYNAMIC_EXECUTION]: The skill uses
node -eto dynamically load and execute a local JavaScript module (./site/build-review-plan.js) to perform validation logic on the practice log.
Audit Metadata