xy-toolchain
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides detailed instructions for using the
xyCLI and associatedpackage-*hooks to manage TypeScript development workflows. These operations involve expected file system interactions such as compiling source code, running linters, executing tests with Vitest, and cleaning build directories. - [INDIRECT_PROMPT_INJECTION]: The
xy workcommand set facilitates the synchronization of local work items with GitHub Issues. This creates a surface where external data (issue titles and descriptions) is brought into the tool's context. - Ingestion points: Local JSON storage in
.xy/work/items/and remote data from GitHub Issues accessed via theghCLI. - Boundary markers: The documentation does not specify the use of delimiters or specific instructions for the agent to ignore embedded commands within the synced content.
- Capability inventory: The toolchain has the ability to write to the file system, execute build/test commands, and interact with the GitHub API.
- Sanitization: There is no mention of specific sanitization or validation protocols for the external data ingested during the sync process.
Audit Metadata