engineering-advanced-skills

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Several tools in the suite, such as autoresearch-agent and agenthub, are designed to execute user-defined benchmark and test commands locally.
  • The run_experiment.py and result_ranker.py scripts utilize subprocess.run with shell=True to facilitate complex shell commands (pipes, redirects) provided in project-local configuration files.
  • Evaluator templates like benchmark_speed.py and test_pass_rate.py execute standard build tools (e.g., npm, pytest, docker) to measure performance metrics.
  • [DYNAMIC_EXECUTION]: The mcp-server-builder utility generates Python or TypeScript server scaffold code derived from OpenAPI contracts provided as input. This is standard behavior for code-generation utilities.
  • [INDIRECT_PROMPT_INJECTION]: Multiple skills in the package ingest and parse structured data from the local repository, including OpenAPI specifications (api-design-reviewer, mcp-server-builder), dependency manifests (dependency-auditor), and git logs (changelog-generator). These tools use standard library parsers (JSON/YAML) to analyze project metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 12:42 AM