craft-goal
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill uses phrases like 'IMPORTANT', 'CRITICAL', and 'Ignore' in the context of its own internal methodology (design-by-contract and lean-startup practices). These are standard instructional terms and do not attempt to bypass agent safety filters or override system-level instructions.
- [COMMAND_EXECUTION]: The skill includes a
scripts/validate.shfile that executes a script (heal.sh) from theskills/skill-builderdirectory. This is a local repository reference for internal skill validation and does not invoke arbitrary or untrusted shell commands. - [DATA_EXFILTRATION]: No network operations or sensitive file access patterns were detected. The skill operates on goal descriptions and architectural design patterns supplied by the user.
- [EXTERNAL_DOWNLOADS]: The skill does not perform any external network requests or download third-party code. All references are local to the skill's file structure.
- [REMOTE_CODE_EXECUTION]: The skill does not contain any remote code execution patterns. It explicitly mandates 'zero goal executions' and 'stop after 1 lint pass,' ensuring it only processes text without running the generated goal prompts.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials, API keys, or secrets were found in the skill or its associated references.
- [NO_CODE]: The skill primarily consists of markdown instructions and a template. The only executable script is a validation utility for development, which is standard for the environment.
Audit Metadata