wire-shared-package
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
uv pip install -eanduv run pythonto verify that local packages are correctly linked and can be imported. These operations are performed on the local file system within the user's project directories. - [INDIRECT_PROMPT_INJECTION]: The skill reads from
pyproject.toml,CLAUDE.md, and Atlas topic files to extract names and descriptions for documentation updates. - Ingestion points: Reads
pyproject.toml,CLAUDE.md,README.md, and files in~/vault/atlas/(SKILL.md). - Boundary markers: None present; data is directly interpolated into templates.
- Capability inventory: Uses
Write,Edit, andBash(uv*)for file modification and local installation. - Sanitization: No specific sanitization or validation of the ingested metadata is performed before interpolation.
- [DATA_EXPOSURE]: The skill searches for and modifies files located in
~/vault/atlas/to maintain a record of shared infrastructure. This behavior is consistent with the skill's stated purpose of tracking dependencies across a research vault.
Audit Metadata