help-me-get-started
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install development tools and configurations from trusted organizations and well-known services, such as Anthropic, Microsoft, and Astral-sh.
- [COMMAND_EXECUTION]: Shell commands are used to configure the development environment (e.g., enabling Windows long paths) and to run a local visualization script,
scripts/show_explainer.py, which helps teach the concepts via the user's browser. - [REMOTE_CODE_EXECUTION]: The skill includes instructions to download and execute setup scripts for standard developer tools from their official domains (e.g., claude.ai, astral.sh, brew.sh).
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined goals and licensing information to tailor its onboarding steps. While this represents a data ingestion surface, the capabilities are strictly limited to providing educational content and assisting with local tool installation.
- Ingestion points: User responses to questions about their goals and technical environment in
SKILL.md. - Boundary markers: Not present for user-supplied input.
- Capability inventory: Shell command execution for tool installation and local script execution to launch a browser.
- Sanitization: Basic alphanumeric sanitization is performed on input titles in
scripts/show_explainer.pywhen creating temporary files.
Audit Metadata