Prompting
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation and
SKILL.mdcontain instructions for executing template rendering viabun run. These are legitimate utility commands designed to facilitate the skill's primary function of programmatic prompt generation. - [DATA_EXPOSURE]: The skill includes a mandatory voice notification mechanism that sends a POST request to
localhost:31337/notify. This is a local service integration used for user alerting and does not transmit sensitive data to external or untrusted domains. - [REMOTE_CODE_EXECUTION]: The skill references standard package management commands (
bun install) in the tools documentation for setting up the TypeScript-based rendering engine. The dependencies (Handlebars, YAML) are well-known, versioned, and sourced from official registries. - [PROMPT_INJECTION]: The skill contains a
Standards.mdfile that explicitly provides guidelines for creating robust prompts. It advocates for 'Ideal-State Prompting' and includes 'Safety-gate' as a legitimate category for maintaining AI boundaries, which serves to enhance rather than undermine prompt security.
Audit Metadata