do-setup

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project files and skill descriptors to generate project configuration documents.
  • Ingestion points: Reads README.md, dependency manifests, and SKILL.md files from project-local and global directories.
  • Boundary markers: The extracted information is merged into markdown tables in the resulting configuration file (CLAUDE.md, AGENTS.md, etc.). The skill does not define specific delimiters to wrap this untrusted content.
  • Capability inventory: The skill has the ability to write to files, create/delete directories, and invoke other platform skills.
  • Sanitization: There is no explicit sanitization or escaping of the data extracted from project files before it is included in the configuration output.
  • [COMMAND_EXECUTION]: Uses standard shell utilities for file system management during the setup process.
  • Evidence: Step 5 executes mkdir, cp, rm, and cmp to install agent definitions and clean up legacy orchestration files. Step 6 uses bash to append to the .gitignore file.
  • [PERSISTENCE]: Installs persistent agent and command definitions into the project's hidden configuration directories.
  • Evidence: Step 5 populates directories like .claude/agents/, .github/agents/, or .opencode/commands/ with new instruction files, which become persistent entry points for the AI tool in that project.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 08:14 PM