shipwright
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation and update of the Shipshape suite using npx commands (e.g.,
npx skills add dmytri/shipshape). These resources are vendor-owned tools provided by the skill's author. - [COMMAND_EXECUTION]: The agent is instructed to execute shell commands for code analysis, including repository status checks (
git status), package management operations (installation and upgrades), and project-specific verification tools (lint, typecheck, coverage) derived from the project's configuration. - [PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted production code, documentation, and Git history. The risk of indirect prompt injection is mitigated through the use of structured analysis tools and a human-in-the-loop review workflow.
- Ingestion points: The skill reads production source code,
.featurefiles, Git history, and project configuration files (RIGGING.md,AGENTS.md). - Boundary markers: The workflow defines a strict separation of concerns where the agent proposes changes that must be verified by a "Captain" role (human or separate agent) before promotion.
- Capability inventory: The skill has capabilities for shell command execution, file system modification (writing scenarios and annotations), and package management.
- Sanitization: The skill relies on stack-native analysis tools (e.g.,
knip,c8,vulture) and requires validation of results through dry-runs and linting before finalization.
Audit Metadata