stackshift-core
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands like
touchandcpduring its bootstrap and variant implementation phases. These operations are intended for local project scaffolding, such as creating empty component files and materializing protocol documentation within the project's directory. - [PROMPT_INJECTION]: The workflow processes user-provided inputs and reference files (HTML, TSX, images) to generate Sanity schemas and React components. This ingestion of external data is a standard functional requirement for a code-generation tool and is managed through a multi-step implementation framework.
- [SAFE]: No evidence of hardcoded credentials, malicious obfuscation, unauthorized data exfiltration, or remote code execution from untrusted sources was found. The skill relies on well-known development libraries and follows established project-builder conventions.
Audit Metadata