project
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard system utilities including
git,jq, andawkto manage project metadata, generate registry entries, and maintain repository configurations. These operations are scoped to the project's own directory and the tool's internal configuration paths (~/.claude/aida/). - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data from
project.json,project_state.md, andCLAUDE.md. While these files are under user control and represent an ingestion surface for potential indirect instructions, the skill mitigates risk by using structured data parsing (viajq), specific line-matching patterns (sed), and explicit HTML comment delimiters (<!-- task-rule:begin -->) to scope the instructions it writes into repositories. - [SAFE]: No malicious patterns such as unauthorized network exfiltration, obfuscation, or privilege escalation were detected. The skill enforces a strict human-in-the-loop policy for sensitive actions like uninstalling components, modifying user-owned repository instructions (task-rule), and unregistering projects located outside the default project base directory. These actions are explicitly blocked in autonomous run modes (exit 70) to prevent unauthorized automated changes.
Audit Metadata