gtm-get-started
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a procedure to download and install the author's primary toolset using
npx skills add eliasstravik/gtm-skills -g -yif the local environment is missing required components. This represents a functional dependency on the author's own repository. - [COMMAND_EXECUTION]: The skill triggers shell-level package management via
npxto handle installation of missing skills. - [INDIRECT_PROMPT_INJECTION]: The skill reads from potentially user-controlled files to determine the next setup step.
- Ingestion points: Reads
icps/*/ICP.md,personas/*/PERSONA.md, and../gtm-workspace/references/contract.md. - Boundary markers: None observed; the skill reads entire files to detect the presence of data.
- Capability inventory: Executes shell commands (
npx) for installation; however, it delegates all file-writing tasks to the specific sub-skills it invokes. - Sanitization: None observed; the skill operates as a high-level orchestrator.
Audit Metadata