skills/dmytri/shipshape/captain/Gen Agent Trust Hub

captain

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs shell commands for repository management using Git, automated testing via npx cucumber-js, and project shipping operations. It retrieves specific commands for outbound actions from a local configuration file and performs 'Perturbation' by injecting specific error-throwing statements into production code for verification purposes.
  • [EXTERNAL_DOWNLOADS]: During project initialization and toolchain setup, the skill is instructed to install packages from official registries. It references well-known development tools including Cucumber, Biome, Playwright, and others.
  • [DATA_EXFILTRATION]: The skill includes workflows for publishing and releasing code artifacts. These actions are protected by a requirement for explicit human approval before the agent performs any outbound tasks.
  • [PROMPT_INJECTION]: The skill processes project-specific files such as AGENTS.md and .feature specs which represent an indirect prompt injection surface.
  • Ingestion points: Reads project-level configuration and documentation files from the repository.
  • Boundary markers: Uses specific domain-specific language and structured templates to maintain role boundaries.
  • Capability inventory: Includes file system writes, git operations, package management, and script execution.
  • Sanitization: Relies on specific workflow logic and user confirmation checkpoints for sensitive outbound tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 05:05 PM
Security Audit — agent-trust-hub — captain