skills/c0nant/skills/setup-skills/Gen Agent Trust Hub

setup-skills

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes several command-line tools including git, gh (GitHub CLI), glab (GitLab CLI), and jq to perform its setup tasks.
  • It executes git remote -v and reads .git/config to identify the repository's origin.
  • It uses gh or glab templates to interact with remote issue trackers for project management.
  • It employs a shell script involving jq to safely merge security restrictions into the .claude/settings.json file, which is a standard procedure for configuring project-specific agent permissions.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests data from local project files (such as CLAUDE.md and CONTEXT.md) and external issue trackers.
  • Ingestion points: Reads repository metadata, local documentation files, and issue/pull request content from GitHub or GitLab.
  • Boundary markers: The skill explicitly requires a human-in-the-loop workflow, instructing the agent to present findings and draft content to the user for confirmation and editing before any write operations occur.
  • Capability inventory: The skill can read/write local files and execute specific CLI tools for source control and issue management.
  • Sanitization: Relies on user review of proposed changes to configuration files and documentation before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 01:08 PM
Security Audit — agent-trust-hub — setup-skills