skills/dojoengine/book/dojo-init/Gen Agent Trust Hub

dojo-init

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to run sozo and katana commands for project initialization, building, deployment, and testing as part of the standard Dojo development workflow.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the dojo-starter template from the official dojoengine GitHub repository during the project initialization process.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests a user-supplied project name which is then used within shell commands, creating a potential surface for indirect instruction or command injection.
  • Ingestion points: User-provided project name ([name]) used in initialization prompts and commands.
  • Boundary markers: None explicitly defined in the skill instructions to delimit user input from shell command structures.
  • Capability inventory: Includes the Bash tool for executing CLI commands and Write/Glob tools for file system manipulation.
  • Sanitization: The skill does not define explicit sanitization or validation logic for the input project name.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 03:19 AM