cli-forge-description
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
cargo build,cargo test,cargo clippy, andcargo fmtwithin the generated project directory. These commands are standard Rust utilities used here to ensure that the newly created project boilerplate is functional and adheres to community standards. - [PROMPT_INJECTION]: The skill exhibits an indirect injection surface by interpolating user-supplied input into generated code. 1. Ingestion points:
skill_nameanddescriptionfields in the scaffolding instructions. 2. Boundary markers: Absent. 3. Capability inventory: Local command execution (cargo) on generated files. 4. Sanitization: Theskill_nameis validated against a restrictive kebab-case regex, while thedescriptionfield lacks explicit sanitization. This surface is considered safe as the inputs are primarily used in string literals and documentation within the generated project.
Audit Metadata