sonamu-cli

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the sonamu and @sonamu-kit/cli packages from the public NPM registry using pnpm.- [COMMAND_EXECUTION]: The skill revolves around the execution of the sonamu CLI tool via shell commands. These commands perform operations such as entity inspection, code scaffolding, database migrations, and fixture management.- [INDIRECT_PROMPT_INJECTION]: The skill processes structured data from CLI outputs, which can contain untrusted content that might influence agent logic.
  • Ingestion points: Data is ingested via the stdout of pnpm sonamu commands when using the --json flag, as documented in references/automation.md.
  • Boundary markers: The skill uses a JSON envelope structure ({"ok":true, "data":...}) to define the boundaries of the tool's response.
  • Capability inventory: The skill facilitates file writes (scaffolding and migrations), database interaction (fixtures and migrations), and subprocess execution (CLI commands) across SKILL.md.
  • Sanitization: No specific sanitization or validation of the data payload is mentioned beyond checking the ok status field.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 11:26 AM