using-gabrielmoreira-skills
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a meta-instruction set that manages agent behavior and routes work to other specialized internal skills. It does not contain malicious code, obfuscation, or persistence mechanisms.
- [DYNAMIC_EXECUTION]: The skill defines a standard workflow where the agent generates temporary Node.js scripts (
.mjs) for data analysis. These are stored in a local, ignored directory (.local/) to prevent accidental commits, representing a safe and intended development pattern. - [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface where the agent ingests project-specific data (README files, diagnostics, command output) to determine which specialized skill to route to. The routing logic is restricted to selecting internal instructions and does not execute untrusted logic based on the ingested content.
- [CREDENTIALS_UNSAFE]: The skill explicitly includes security-positive instructions, commanding the agent never to commit machine paths, environment values, credentials, or sensitive company/product names found in the development environment.
Audit Metadata