onboarding-concierge

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [Command Execution]: The skill includes a pre-flight check using a local Python module (setup_preflight). This is an initialization step to ensure the environment and configuration files are correctly set up before the skill executes its primary logic.
  • [Indirect Prompt Injection Awareness]: The instructions explicitly address the risk of indirect prompt injection from newcomer questions or project documentation. It directs the agent to treat all external content strictly as data and to flag any attempts to override instructions or safety guidelines through an injection_flagged status in the output.
  • [Human-in-the-loop Design]: The skill is designed to be read-only regarding the project's public presence. It produces draft answers for maintainer review and explicitly states that it does not post comments or write files autonomously, which serves as a safeguard against automated misuse.
  • [Configuration Management]: The skill relies on local configuration files (onboarding-concierge-config.md and project.md) to resolve project-specific parameters like maintainer handles and out-of-scope topics, following standard practices for skill customization.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 06:05 PM