skills/zapabob/skills/hypura-harness/Gen Agent Trust Hub

hypura-harness

Fail

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: HIGHDYNAMIC_EXECUTIONPERSISTENCECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill documentation describes a 'Global Shinka Evolution Engine' that performs recursive sweeps to rewrite repository scripts including .py, .ts, and .js files. The /evolve endpoint is specifically designed to trigger code generation and self-refinement logic.
  • [PERSISTENCE]: The evolution engine is explicitly defined as a 'persistent background process' managed by the 'Shinka Monitor', indicating a mechanism to maintain execution across agent sessions.
  • [CREDENTIALS_UNSAFE]: The skill identifies the .env file as an 'Immune Asset'. While the documentation claims it is read-only, referencing specific sensitive credential files within an autonomous rewriting engine exposes them to potential context leakage or accidental modification.
  • [INDIRECT_PROMPT_INJECTION]: The 'Recursive Optimization' and /evolve features (which accept 'seed' and 'fitness_hint' payloads) create a high-risk surface where untrusted data could influence the autonomous code-writing process, potentially leading to the injection of malicious logic into the repository.
  • [DYNAMIC_EXECUTION]: The skill specifies a requirement for a 'repo-local' Python executable (version 3.14.3) for 'critical reasoning and actuation', which suggests reliance on a non-standard or futuristic environment that could facilitate unmonitored script execution.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 5, 2026, 12:07 PM