skills/bcgen/skills/ai-init/Gen Agent Trust Hub

ai-init

Pass

Audited by Gen Agent Trust Hub on Jul 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides a template in references/init-playbook.md that includes a shell command: npx skills add <owner>/<repo>. This command is written into the project's entry documentation (e.g., CLAUDE.md) as an instruction for the user or other agents. While this skill does not execute the command itself, it persists a command that triggers external code execution in a primary project file.
  • [EXTERNAL_DOWNLOADS]: The referenced npx command facilitates the download and execution of packages from the npm registry. The skill attempts to resolve the <owner>/<repo> placeholder from the local git remote to point to specific external code repositories.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by reading data from external files to generate project instructions.
  • Ingestion points: The skill reads package.json, Makefile, and various CI configuration files in Step 3 to "gather verified facts" about the project's build, test, and lint commands.
  • Boundary markers: The skill uses explicit delimiters (<!-- harness:begin --> and <!-- harness:end -->) to wrap the content it generates, providing a clear boundary between agent-managed and user-managed content.
  • Capability inventory: The skill has the capability to create and modify files in the project root and specific directories such as .ai/learnings/ and .cursor/rules/.
  • Sanitization: The skill implements a "Plan and show diffs" step (Step 4) which requires explicit user approval for every change. It also includes an idempotency check to ensure no unauthorized or repeated changes are made.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 6, 2026, 08:03 AM
Security Audit — agent-trust-hub — ai-init