new-project-setup
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands for repository setup, specifically
git initto initialize the directory andinit-cursor.shto configure the Cursor editor environment. - [EXTERNAL_DOWNLOADS]: Fetches project license documentation from the FixMyBerlin organization's GitHub repository (
FixMyBerlin/tilda-geo). - [REMOTE_CODE_EXECUTION]: Uses
bunxto download and execute skill installation scripts from the official FixMyBerlin skills repository (FixMyBerlin/fixmyskills). These are recognized as vendor-owned resources. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided data such as project names and copyright holders which are used to configure the project metadata.
- Ingestion points: User input for project name and copyright holder metadata in SKILL.md.
- Boundary markers: None explicitly defined to separate user input from system instructions.
- Capability inventory: Includes shell command execution (
git,bunx) and file system write operations. - Sanitization: No explicit sanitization or validation of the user-provided strings is documented.
Audit Metadata