setup-ai-workspace
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill explores and ingests content from existing repository files, such as
AGENTS.md, task templates, and contribution documentation, to inform its configuration decisions. This creates an attack surface where instructions embedded in these untrusted files could influence the agent's behavior during workspace setup.\n - Ingestion points: The skill reads
AGENTS.md,.git/config, and various task templates in the repository during the discovery phase.\n - Boundary markers: No explicit delimiters or safety warnings are used to isolate content read from files from the agent's core instructions, although the skill requires human confirmation before performing write operations.\n
- Capability inventory: The skill can modify the project's steering file (
AGENTS.md) and interact with remote GitHub or GitLab instances using CLI tools.\n - Sanitization: There is no evidence of sanitization or filtering for the content read from repository documents.\n- [COMMAND_EXECUTION]: The skill utilizes shell commands including
git remote -v,gh issue, andglab issueto discover project metadata and manage remote task records. These are standard operations for the skill's intended purpose but represent a capability to execute commands based on configuration found in the repository.
Audit Metadata