fw-review
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local bash scripts situated in the user's home directory (
~/.fw-dev-tools/scripts/) and spawns thefdkCLI tool. These commands are utilized for session management, metadata tracking, and application validation as part of the audit process. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code and configuration files from the application being audited. This ingestion of external data creates a surface for indirect prompt injection, where adversarial content in the reviewed files could attempt to manipulate the agent's interpretation of the audit rules or the final report generation.
Audit Metadata