install-wizard
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill modifies the user's shell configuration (~/.zshrc) to add a hook that runs on every terminal start. While documented as a feature for audit notifications, this creates a persistent execution point in the user environment.
- [COMMAND_EXECUTION]: The skill utilizes shell commands and Python blocks for environment discovery, file system operations, and configuration management.
- [DYNAMIC_EXECUTION]: The skill dynamically generates and registers SessionStart hooks within agent configuration files (settings.json and settings.local.json) using Python scripts to automate setup.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the fh-meta plugin and the phantom-gate package from the vendor's GitHub repositories.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes existing instruction files (CLAUDE.md, rules files) which could contain malicious data.
- Ingestion points: Analyzes local project files including CLAUDE.md, .claude/rules/*.md, requirements.txt, and .claude.json.
- Boundary markers: Implements a strict 'Propose-First' policy requiring per-item user approval before any file writes or configuration changes.
- Capability inventory: Uses Bash, Write, and Edit tools to modify configuration files, update shell profiles, and install external plugins.
- Sanitization: Includes a pre-flight scan that uses grep to detect known prompt injection and data exfiltration patterns in instruction files before processing them.
Audit Metadata