code-quality
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install standard development dependencies from official registries (npm, PyPI), such as eslint, prettier, ruff, and mypy. It also references official GitHub Actions for CI workflows.
- [COMMAND_EXECUTION]: The skill includes shell commands for package installation and running linters (e.g., npm install, pip install, ruff check, mypy). These are standard operations for code quality enforcement within a development environment.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it auto-detects project stacks and configurations by reading files like package.json and pyproject.toml, which could contain malicious instructions.
- Ingestion points: Marker files including package.json, tsconfig.json, pyproject.toml, and existing linter configuration files.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded instructions when parsing these files.
- Capability inventory: The skill possesses file system write access for config generation and subprocess execution for installing packages and running tools.
- Sanitization: No explicit sanitization or validation of the content within the detected project files is described.
Audit Metadata