join

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the official hackathon CLI tool using npm i -g @antasphere/hackathon@latest. This is a vendor-owned package required for the hackathon setup.
  • [COMMAND_EXECUTION]: The skill sequences several shell commands including docker compose, git clone, and openssl to generate secrets. It also uses platform-specific commands like open, xdg-open, or start to launch the application in a browser.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes output from the CLI tool in JSON format. It is designed to interpret specific fields (such as eligibility and repository.state) to determine the next steps in the setup process. The skill includes specific instructions to handle different exit codes and error messages from the CLI.
  • [SAFE]: The skill demonstrates high security awareness by instructing the agent to never ask for or print secrets, to generate passwords locally using openssl, and to set secure file permissions (chmod 600) on environment files. It also explicitly requires that sensitive operations like sudo or credential entry be performed by the user manually in their own terminal.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 11:03 AM