store-custodian
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill performs operations by invoking a local Node.js script (
store-cli.cjs) located within the project's directory structure. It passes arguments and JSON strings to this CLI for data management tasks. - [DYNAMIC_EXECUTION]: A Node.js one-liner is used to resolve the
FORGE_ROOTenvironment variable by reading a path from a local configuration file (.forge/config.json). This is a standard path resolution technique for local developer tools. - [INDIRECT_PROMPT_INJECTION]: The skill processes data stored in JSON files which could potentially contain untrusted content. However, the risk is mitigated by the use of a dedicated CLI that performs schema validation and atomic updates, and the skill instructions emphasize using this CLI rather than direct file manipulation.
Audit Metadata