model-prepare
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- Command Execution: The skill utilizes local Python modules and scripts, such as
setup_preflightandmodel_pr.py, to manage configuration verification and automate the Pull Request process. These tools are part of the skill's infrastructure for ensuring environment readiness and landing deliverables.\n- Indirect Prompt Injection Surface: The skill's primary function involves processing external repository content, including source code and issue history. The instructions include specific directives to treat this content strictly as data rather than instructions, mitigating the risk of embedded malicious text influencing the agent's behavior.\n- External Resource Integration: The skill references external threat-modeling guidelines from the Alpha-Omega security project. It is designed to delegate specific authoring tasks to these external tools if they are available in the environment, following established open-source security rubrics.\n- Dynamic Execution Patterns: The pre-flight process involves executing a tool that returns structured rules for the agent to follow. This pattern is used to reconcile project-specific configurations and ensure the skill operates within the maintainers' defined constraints.
Audit Metadata