do-setup
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project files and skill descriptors to generate project configuration documents.
- Ingestion points: Reads README.md, dependency manifests, and SKILL.md files from project-local and global directories.
- Boundary markers: The extracted information is merged into markdown tables in the resulting configuration file (CLAUDE.md, AGENTS.md, etc.). The skill does not define specific delimiters to wrap this untrusted content.
- Capability inventory: The skill has the ability to write to files, create/delete directories, and invoke other platform skills.
- Sanitization: There is no explicit sanitization or escaping of the data extracted from project files before it is included in the configuration output.
- [COMMAND_EXECUTION]: Uses standard shell utilities for file system management during the setup process.
- Evidence: Step 5 executes mkdir, cp, rm, and cmp to install agent definitions and clean up legacy orchestration files. Step 6 uses bash to append to the .gitignore file.
- [PERSISTENCE]: Installs persistent agent and command definitions into the project's hidden configuration directories.
- Evidence: Step 5 populates directories like .claude/agents/, .github/agents/, or .opencode/commands/ with new instruction files, which become persistent entry points for the AI tool in that project.
Audit Metadata