super-linting

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches up-to-date linter tables and configuration from the official Super-Linter GitHub repository to provide accurate tool recommendations.\n- [INDIRECT_PROMPT_INJECTION]: The skill uses content from an external repository's README to identify which commands to execute and suggest to the user, creating a dependency on the integrity of the remote file.\n
  • Ingestion points: SKILL.md (Step 2) fetches https://raw.githubusercontent.com/super-linter/super-linter/main/README.md via WebFetch.\n
  • Boundary markers: No delimiters or specific instructions to ignore embedded commands are provided for the fetched content.\n
  • Capability inventory: The skill can execute various package managers (npm, pipx, brew, gem, cargo, rustup), write to local configuration files (Makefile, AGENTS.md, README.md), and configure git hooks.\n
  • Sanitization: No sanitization or validation of the fetched Markdown table is performed before mapping it to installation commands.\n- [COMMAND_EXECUTION]: Performs shell checks for tool availability and executes package installation commands for various development ecosystems (ruff, eslint, golangci-lint, etc.) after obtaining user confirmation.\n- [PERSISTENCE]: Offers to install git pre-commit hooks and persistent agent instructions in AGENTS.md or CLAUDE.md to ensure linting is performed in all future sessions.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 06:08 PM