github-repo-init-acrazie
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python helper script (
scripts/engineering_activation.py) that manages the project lifecycle. This script executes shell commands via thesubprocessmodule to perform file hashing and identifies commands for the agent to execute, such as repository scaffolding withpnpm,uv, orcargo. - [DYNAMIC_EXECUTION]: The activation script executes a static, embedded Node.js snippet via
subprocess.runto ensure that folder hashes calculated during project planning are consistent with the JavaScript-based installer's collation logic. - [EXTERNAL_DOWNLOADS]: The 'Engineering Activation' feature guides the agent to download and install versioned toolkits from the vendor's GitHub repository (
Acrazie/skills) using thenpxpackage runner. - [INDIRECT_PROMPT_INJECTION]: The skill performs an automated discovery phase where it reads local manifest files (e.g.,
package.json,pyproject.toml) to determine the project stack and reduce user prompts. It utilizes clear markdown boundary markers (<!-- acrazie-engineering:start -->) to delineate its managed sections within project documentation files likeAGENTS.mdandCLAUDE.md.
Audit Metadata