project-deploy-portfolio-sync
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external repositories and HTML files, which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Application repository files processed during lint and build phases in scripts/project_status_check.sh, and HTML files in the andrewsolomon.dev repository searched via rg in scripts/portfolio_entry_check.sh.
- Capability inventory: Execution of shell commands including git, rg, npm, and bun.
- Boundary markers: None identified; the skill does not use specific delimiters or instructions to ignore potential commands embedded in the processed files.
- Sanitization: The skill does not perform sanitization or validation on the content of the files it reads before processing or displaying results.
- [COMMAND_EXECUTION]: The skill executes npm run build, npm run lint, bun run build, and bun run lint within the target project directory. This triggers the execution of scripts defined in the project's package.json, which involves executing code from the repository being deployed.
Audit Metadata