finish-with-dev-server
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill parses untrusted local files to determine which shell commands to execute.
- Ingestion points: Reads project-controlled files including
AGENTS.md,README.md,docs/stack.md,.env.example,vite.config.*, andpackage.json. - Boundary markers: No explicit delimiters or instructions to ignore embedded malicious prompts within these files are provided.
- Capability inventory: The skill is granted the capability to start new processes and terminate (kill) existing processes based on the parsed data.
- Sanitization: No validation or sanitization of the commands extracted from documentation is mentioned before execution.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to start missing processes "without asking permission" using documented commands found in the repository. It also permits killing processes owning specific ports if they belong to the "same project."
Audit Metadata