make-money
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill utilizes role-playing instructions ('You are the friend who tells the truth') and behavioral directives ('No flattery. No hedging') to define the AI's persona for the duration of the audit. This ensures the output remains focused on critical business feedback rather than general development assistance.
- [COMMAND_EXECUTION]: The workflow includes executing standard shell commands such as
git logto evaluate recent development velocity andgrepto search for payment provider integrations (e.g., Stripe, Lemon Squeezy). These actions are consistent with the skill's purpose of analyzing a project's commercial readiness. - [PROMPT_INJECTION]: The skill ingests data from untrusted sources within the project, such as
README.md,docs/,issues/, andPRD*files, to understand the project's scope and goals. - Ingestion points: Project documentation, requirement files, and issue trackers.
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within these files.
- Capability inventory: The skill allows reading local files, executing search commands, and querying the user for more information.
- Sanitization: The skill does not describe any specific mechanisms for filtering or sanitizing the content of the files it reads before processing them.
Audit Metadata