project-init
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several standard shell commands to inspect the local environment and manage project state, including
ls,find,git, andmake. These are used appropriately to detect existing project files, initialize git repositories, and verify the generated setup.\n- [COMMAND_EXECUTION]: Executes a local initialization script (plugins/attune/scripts/attune_init.py) to apply project templates. The skill includes metadata validation steps, such as name format and email format checks, to mitigate command injection risks when interpolating user-provided values into script arguments.\n- [PROMPT_INJECTION]: The skill ingests data from the local environment (directory listing, git configuration) and user input to drive the initialization process. While this creates an indirect prompt injection surface (Category 8), the skill implements validation for project metadata and focuses on its intended scaffolding task.\n- [COMMAND_EXECUTION]: Generates project files such aspyproject.toml,Makefile, and source code directories by rendering local templates with user-provided metadata. This dynamic file creation is a core part of the project's purpose and follows defined safety checks including permission verification and conflict handling.
Audit Metadata