agent-development-repo-bootstrap

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script bootstrap_agent_development_repo.py uses subprocess.run to execute a locally generated validator script (check-agent-harness.py) if the --validate flag is enabled. The execution is limited to the skill's own generated content within the target project directory.
  • [SAFE]: The skill generates security-focused documentation and policies, including a 'Secrets Policy' that enforces .gitignore rules for credentials and a 'Human Gates' policy requiring manual approval for high-risk operations.
  • [SAFE]: The included validator script (check-agent-harness.py) acts as a security linter, using regular expressions to scan for dangerous patterns such as curl piped to shell (S5 failure code) and hardcoded private file paths.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 04:06 PM
Security Audit — agent-trust-hub — agent-development-repo-bootstrap