youmind-slides-generator
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
youmindCLI andnodescripts to interact with the backend service and process data. - Evidence:
SKILL.mdinvokesyoumind callfor various API operations andnode -eto parse message outputs. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@youmind-ai/clipackage from the public NPM registry. - Evidence: The workflow in
SKILL.mdchecks for and installs@youmind-ai/cliusingnpm install -gif it is missing. - [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from the YouMind API, which could theoretically contain instructions intended to influence the agent's behavior.
- Ingestion points: The
youmind call listMessagescommand inSKILL.md(Step 5) fetches external content into the agent's context. - Boundary markers: None identified for the raw data ingestion.
- Capability inventory: The skill uses
youmindCLI commands,npm install, andnode -efor execution. - Sanitization: The skill uses a
nodescript to specifically parse and extract tool result blocks from the JSON response, effectively filtering for structured data rather than interpreting general text as instructions.
Audit Metadata