programming
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Documentation and code comments (e.g., in
scripts/go/new-project.pyandreferences/python/one-liners.md) provide commands to install the 'uv' tool via piped bash scripts from the well-known domain astral.sh. - [EXTERNAL_DOWNLOADS]: The skill facilitates environment setup by referencing established technology stacks and official package registries for libraries such as Gin, SQLC, and Hono.
- [COMMAND_EXECUTION]: Project initialization scripts use subprocess calls to execute necessary environment setup commands like 'go mod init', 'cargo init', and 'uv init'. These operations use list-based arguments to mitigate injection risks and are required for the skill's primary scaffolding purpose.
- [PROMPT_INJECTION]: The skill employs strong instructional mandates to enforce specific coding standards and personas. Additionally, Category 8 risk is noted: Ingestion points: 'scripts/python/check-no-excuse-rules.py' reads local source code. Boundary markers: None. Capability inventory: Project scaffolding scripts contain subprocess calls. Sanitization: Checker scripts utilize AST parsing for structural analysis. Severity: LOW.
- [SAFE]: The provided project templates for .gitignore files (e.g., in
scripts/go/templates/) correctly include entries for .env files and private keys, demonstrating appropriate data exposure prevention measures.
Audit Metadata