setup-arcreel-skills

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides instructions for standard service configuration. It describes how to verify and store connection details and API keys in local configuration files such as .arcreel/settings.json and host-specific settings. This behavior is consistent with the intended purpose of a setup utility for a developer service.
  • [PERSISTENCE]: The skill establishes persistent connectivity by instructing the agent to save the mcp_url and api_key to local files and the host environment. This allows the agent to maintain its connection to the remote service across different sessions without manual reconfiguration.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a data ingestion surface by reading from and writing to the .arcreel/settings.json workspace file.
  • Ingestion points: Reads connection parameters from .arcreel/settings.json in the local workspace.
  • Boundary markers: None explicitly defined in the configuration format.
  • Capability inventory: The skill uses file-writing capabilities to save settings and performs tool calls (list_projects) based on the ingested configuration.
  • Sanitization: The skill uses specific format checks (e.g., endpoint must end in /mcp, API key must start with arc-) which provides basic validation for the ingested data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 02:53 PM