skills/0froq/skills-pack/whittle/Gen Agent Trust Hub

whittle

Pass

Audited by Gen Agent Trust Hub on Nov 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a local shell script (scripts/whittle.sh) to perform static analysis and rendering of Markdown-based decision trees. The script is self-contained and uses awk for parsing, avoiding dangerous functions or external command execution.\n- [EXTERNAL_DOWNLOADS]: The skill documentation includes a link to the author's GitHub repository (github.com/0froq/skills-pack) for source information. No remote code or assets are downloaded or executed by the skill during runtime.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes repository files (e.g., decisions.md) to extract design questions and decisions. \n
  • Ingestion points: Markdown files specified by the user as arguments to the script.\n
  • Boundary markers: Content is structured using a specific grammar (headings for IDs, prefix labels for fields like status: and edges:).\n
  • Capability inventory: The agent executes scripts/whittle.sh which reads the file and performs basic parsing and logic checks via awk.\n
  • Sanitization: The Bash script employs an awk parser that specifically looks for defined field markers and sanitizes input (e.g., removing tabs from titles) before processing.\n- [SAFE]: No malicious patterns, such as obfuscation, credential exfiltration, or unauthorized persistence, were identified. The skill's behavior is consistent with its stated purpose of managing design documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 11, 2026, 02:55 AM