forge-onboarding
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install the official Atlassian Forge CLI (
@forge/cli) and the@forge/apipackage from public registries. These are standard developer tools provided by the vendor. - [COMMAND_EXECUTION]: The workflow involves executing standard Forge CLI commands (
forge create,forge deploy,forge install) and a Python helper script from a sibling repository (forge-app-builder). The skill requires the agent to narrate commands, explain their impact, and obtain explicit user authorization before execution. - [INDIRECT_PROMPT_INJECTION]: The application created by the skill (Forge Guru) is designed to ingest search results from Atlassian's developer documentation. To mitigate potential prompt injection attacks within the generated agent, the manifest template includes specific instructions for the agent to treat external search results as data rather than instructions.
Audit Metadata