verification-loop
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several standard development commands locally to verify project integrity.
- Executes
npm run build,pnpm build,npx tsc,pyright,ruff, andnpm run testto validate the codebase. - Uses
git diffto review changes. - Uses
grepto scan for potential secrets (e.g., "sk-", "api_key") and debugging statements in the project files. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from command outputs which could theoretically contain instructions intended to influence the agent's summary.
- Ingestion points: Standard output and error streams from build tools, test runners, and linters (SKILL.md).
- Boundary markers: None; the agent processes the raw tail/head of the command outputs.
- Capability inventory: The skill has access to shell execution via the agent's environment to run project-specific scripts.
- Sanitization: None; the agent is expected to interpret the logs directly.
Audit Metadata