alias
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local helper scripts located within the plugin's installation directory (
larch.sh). These scripts are used for configuration and validation tasks. The execution is guarded by strict input validation and the use of safe shell patterns. - [INDIRECT_PROMPT_INJECTION]: User-provided arguments such as alias names and target skills are processed. To mitigate injection risks, the skill applies regex filters (
^[a-z][a-z0-9-]*$) and explicitly forbids the use ofevalwhen processing script output, as noted in the 'NEVER' section of the instructions. - [DYNAMIC_EXECUTION]: The skill generates a deterministic build recipe for another skill (
/implement). This recipe involves calling local installation scripts with parameters that have been validated, ensuring that the generated code follows the expected platform structure.
Audit Metadata