sonamu-cli
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
sonamuand@sonamu-kit/clipackages from the public NPM registry usingpnpm.- [COMMAND_EXECUTION]: The skill revolves around the execution of thesonamuCLI tool via shell commands. These commands perform operations such as entity inspection, code scaffolding, database migrations, and fixture management.- [INDIRECT_PROMPT_INJECTION]: The skill processes structured data from CLI outputs, which can contain untrusted content that might influence agent logic. - Ingestion points: Data is ingested via the stdout of
pnpm sonamucommands when using the--jsonflag, as documented inreferences/automation.md. - Boundary markers: The skill uses a JSON envelope structure (
{"ok":true, "data":...}) to define the boundaries of the tool's response. - Capability inventory: The skill facilitates file writes (scaffolding and migrations), database interaction (fixtures and migrations), and subprocess execution (CLI commands) across
SKILL.md. - Sanitization: No specific sanitization or validation of the
datapayload is mentioned beyond checking theokstatus field.
Audit Metadata