cli-forge-description

Pass

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes cargo build, cargo test, cargo clippy, and cargo fmt within the generated project directory. These commands are standard Rust utilities used here to ensure that the newly created project boilerplate is functional and adheres to community standards.
  • [PROMPT_INJECTION]: The skill exhibits an indirect injection surface by interpolating user-supplied input into generated code. 1. Ingestion points: skill_name and description fields in the scaffolding instructions. 2. Boundary markers: Absent. 3. Capability inventory: Local command execution (cargo) on generated files. 4. Sanitization: The skill_name is validated against a restrictive kebab-case regex, while the description field lacks explicit sanitization. This surface is considered safe as the inputs are primarily used in string literals and documentation within the generated project.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 7, 2026, 03:28 PM
Security Audit — agent-trust-hub — cli-forge-description