workflow-initializer

Pass

Audited by Gen Agent Trust Hub on Nov 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches configuration templates and documentation from the author's official GitHub repository (albertmartorell1975/android-ai-workflow-foundation). This is used to maintain synchronized definitions for the workflow engine and optional plugins.
  • [COMMAND_EXECUTION]: Executes shell commands for project environment inspection, including gh --version for GitHub CLI detection and git init for repository initialization. It also facilitates tool installation via system package managers (winget, brew, apt) upon explicit user confirmation.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files (e.g., settings.gradle.kts) and fetches remote Markdown instructions. While this creates a surface for indirect instructions, the skill implements a 'Hard Stopping Gate' to ensure human oversight before critical configuration files are materialized.
  • [DYNAMIC_EXECUTION]: Generates subagent configuration files (.md) at runtime by injecting specific skill lists into pre-defined templates based on the user-selected AI provider (Gemini, Cursor, or Claude Code).
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 5, 2026, 04:12 PM