forge-init
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, command execution, or remote code downloads were detected. The skill functions as a design utility for generating static configuration files.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided parameters to generate design tokens. While this represents an ingestion point for untrusted data, the risk is minimal as the output is restricted to CSS and JSON configuration.
- Ingestion points: User input parameters
hex-colorandproject-typedefined in SKILL.md. - Boundary markers: None explicitly defined.
- Capability inventory: The agent writes a
.forge.jsonconfiguration file to the local file system. - Sanitization: None specified in the instructions.
Audit Metadata