project-workflow

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses various system tools such as git, npm, and the GitHub CLI (gh) to automate project workflows, including commits, builds, and repository management. These operations are restricted to the local project environment and are consistent with the skill's primary purpose.
  • [EXTERNAL_DOWNLOADS]: The release command provides instructions to download the gitleaks security tool from its official GitHub repository for secret detection. These references target well-known and trusted infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The reflect and brief commands analyze the current conversation context and file contents to extract architectural decisions, workflows, and learnings.
  • Ingestion points: Reads the current session history and project files (e.g., SESSION.md, IMPLEMENTATION_PHASES.md).
  • Boundary markers: None explicitly present for conversation analysis; outputs are formatted into markdown files.
  • Capability inventory: The skill has capabilities to write files and execute shell commands via git and npm.
  • Sanitization: The skill organizes extracted information into structured markdown sections but does not detail specific input sanitization for the generated documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 06:55 AM
Security Audit — agent-trust-hub — project-workflow