skills/apocohq/skills/align-repo/Gen Agent Trust Hub

align-repo

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches skill updates and new installations from the vendor's official GitHub repository (apocohq/skills).
  • [COMMAND_EXECUTION]: Executes npx skills commands to manage installation, status checks, and updates of agent skills.
  • [DYNAMIC_EXECUTION]: Uses a skill management utility to dynamically load and update executable logic from the vendor's repository at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from local repository files, which represents a potential attack surface if those files contain malicious instructions.
  • Ingestion points: Reads .claude/settings.json, CLAUDE.md, and .gitignore from the current project directory in Step 1.
  • Boundary markers: No explicit boundary markers or instruction-ignoring warnings are defined for the ingested file content.
  • Capability inventory: The skill can execute npx commands for skill management and perform file write operations to align repo conventions.
  • Sanitization: No explicit sanitization or content validation is performed on the ingested repository data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 01:18 PM