understand
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands and internal scripts (git, node, python, pnpm) to scan the project, manage its own dependencies, and process analyzed data.\n- [EXTERNAL_DOWNLOADS]: Initialization may trigger
pnpm installto prepare the required libraries, which involves connecting to the official npm registry.\n- [PROMPT_INJECTION]: The skill defines a clear security boundary by instructing subagents to treat external project content (READMEs, manifests) as untrusted data and to ignore any instructions found within them, mitigating indirect prompt injection risks.
Audit Metadata