best-practice-first

Pass

Audited by Gen Agent Trust Hub on Apr 2, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill uses search and retrieval tools (WebSearch, WebFetch, Grep, Glob) for their intended purposes of gathering documentation and understanding the codebase. No malicious patterns, obfuscation, or unauthorized access attempts were identified.
  • [PROMPT_INJECTION]: While the skill ingests external content via WebFetch, which is a vector for indirect prompt injection, it implements 'HARD-GATE' constraints requiring user approval of findings and plans. This human-in-the-loop requirement prevents the agent from automatically obeying instructions embedded in external data.
  • [COMMAND_EXECUTION]: File modifications and implementation steps are restricted to a final execution phase that occurs only after the user has explicitly confirmed both the research results and the detailed implementation plan.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 2, 2026, 11:03 PM
Security Audit — agent-trust-hub — best-practice-first