quality-scan
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to run shell commands via the npm CLI, including
npm run quality:scanandnpm run check:gate-manifest. These commands execute logic defined in the project'spackage.jsonfile. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where untrusted data from the repository is ingested into the agent's context.
- Ingestion points: The agent is instructed to read and interpret
package.json,config/quality/gate-manifest.json, and the output logs from the scan process. - Boundary markers: No boundary markers or explicit instructions to ignore instructions within the ingested data are present.
- Capability inventory: The skill allows for shell command execution and file system read/write for logging purposes.
- Sanitization: There is no evidence of sanitization or schema validation for the ingested configuration files or log outputs.
Audit Metadata