setup-bb-skills
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a 'Non-negotiable approval gate' which requires the agent to present all proposed changes (both local and external) to the user and wait for explicit approval before execution, ensuring human oversight for all mutations.
- [SAFE]: The instructions in both SKILL.md and REFERENCE.md explicitly forbid the exposure, handling, or storage of credentials, tokens, or private connection materials within the generated contracts or repository files.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external trackers and repository documentation, creating an ingestion surface for potentially untrusted content (SKILL.md Discovery section). This risk is mitigated by the mandatory human approval gate (boundary marker) which prevents automatic execution of instructions found in data. The skill's capabilities are limited to local file writes (docs/agents/bb-skills.md, AGENTS.md) and tracker tool invocations, with sanitization provided by manual resolution rules and user confirmation of conceptual mappings.
Audit Metadata