unattended-development-v3
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/orchestrate.py) to automate state tracking. The script's operations are confined to reading and writing local JSON state files and parsing project metadata, without any external network or arbitrary command execution. - [PROMPT_INJECTION]: Instructions in
SKILL.mdprovide clear safety boundaries, specifically directing the agent not to auto-confirm stages or bypass human review checkpoints, reinforcing the requirement for manual user verification throughout the orchestration process. - [SAFE]: The system implements security best practices including SHA-256 fingerprinting to detect unauthorized modifications to reviewed artifacts. It also includes path resolution logic in the script to ensure that primary project artifact paths remain within the designated project root, mitigating directory traversal risks.
Audit Metadata