dojo-init
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run
sozoandkatanacommands for project initialization, building, deployment, and testing as part of the standard Dojo development workflow. - [EXTERNAL_DOWNLOADS]: The skill fetches the
dojo-startertemplate from the officialdojoengineGitHub repository during the project initialization process. - [INDIRECT_PROMPT_INJECTION]: The skill ingests a user-supplied project name which is then used within shell commands, creating a potential surface for indirect instruction or command injection.
- Ingestion points: User-provided project name (
[name]) used in initialization prompts and commands. - Boundary markers: None explicitly defined in the skill instructions to delimit user input from shell command structures.
- Capability inventory: Includes the
Bashtool for executing CLI commands andWrite/Globtools for file system manipulation. - Sanitization: The skill does not define explicit sanitization or validation logic for the input project name.
Audit Metadata