state-audit
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Utilizes
rg(ripgrep) to search the codebase for state-related literals, enums, and persistence patterns to build an inventory of implicit state machines. - [EXTERNAL_DOWNLOADS]: Employs
npxorbunxto run the@informalsystems/quinttool. This involves fetching the tool from the official npm registry, which is a standard procedure for running specialized model checkers. - [DYNAMIC_EXECUTION]: Generates and runs temporary models (in TypeScript or Quint) derived from the analyzed code to verify invariants and produce counter-examples for reported bugs.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading source code and project documentation. While this presents a surface for instructions embedded in comments, the risk is minimized by the skill's read-only workflow and requirements for human verification of all findings.
Audit Metadata