engineering-advanced-skills
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Several tools in the suite, such as
autoresearch-agentandagenthub, are designed to execute user-defined benchmark and test commands locally. - The
run_experiment.pyandresult_ranker.pyscripts utilizesubprocess.runwithshell=Trueto facilitate complex shell commands (pipes, redirects) provided in project-local configuration files. - Evaluator templates like
benchmark_speed.pyandtest_pass_rate.pyexecute standard build tools (e.g.,npm,pytest,docker) to measure performance metrics. - [DYNAMIC_EXECUTION]: The
mcp-server-builderutility generates Python or TypeScript server scaffold code derived from OpenAPI contracts provided as input. This is standard behavior for code-generation utilities. - [INDIRECT_PROMPT_INJECTION]: Multiple skills in the package ingest and parse structured data from the local repository, including OpenAPI specifications (
api-design-reviewer,mcp-server-builder), dependency manifests (dependency-auditor), and git logs (changelog-generator). These tools use standard library parsers (JSON/YAML) to analyze project metadata.
Audit Metadata