typst-toolchain-maintainer
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (
.github/scripts/update-toolchain.py) and Docker build commands (docker buildx bake) to automate version updates and verify buildability. These are standard operations for repository maintenance tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from the local repository (scripts, Dockerfiles, and HCL files) to determine how to apply updates. This creates a surface where compromised repository files could influence the agent's behavior.
- Ingestion points: Reads
.github/scripts/update-toolchain.py,src/typst/Dockerfile,src/typst/docker-bake.hcl, andsrc/typst/devcontainer-template.json. - Boundary markers: None explicitly defined in the prompt interpolation; behavior relies on the agent following the maintenance workflow.
- Capability inventory: Executes Python scripts and Docker build commands.
- Sanitization: The skill instructions advise reviewing the diff of the updater script before finalizing changes.
Audit Metadata