onboarding-concierge
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [Command Execution]: The skill includes a pre-flight check using a local Python module (
setup_preflight). This is an initialization step to ensure the environment and configuration files are correctly set up before the skill executes its primary logic. - [Indirect Prompt Injection Awareness]: The instructions explicitly address the risk of indirect prompt injection from newcomer questions or project documentation. It directs the agent to treat all external content strictly as data and to flag any attempts to override instructions or safety guidelines through an
injection_flaggedstatus in the output. - [Human-in-the-loop Design]: The skill is designed to be read-only regarding the project's public presence. It produces draft answers for maintainer review and explicitly states that it does not post comments or write files autonomously, which serves as a safeguard against automated misuse.
- [Configuration Management]: The skill relies on local configuration files (
onboarding-concierge-config.mdandproject.md) to resolve project-specific parameters like maintainer handles and out-of-scope topics, following standard practices for skill customization.
Audit Metadata