setup-my-iq

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses PowerShell commands on Windows (and POSIX equivalents on macOS/Linux) to manage agent configuration. Specifically, it uses New-Item -ItemType SymbolicLink to create links between different instruction files (e.g., symlinking .claude/CLAUDE.md to .agents/AGENTS.md). It also includes a check for Windows Developer Mode using Get-ItemPropertyValue to ensure the environment supports symlink creation.
  • [DATA_EXFILTRATION]: The skill is designed to gather factual information from authorized data sources such as the user's work profile, calendar, mail, and Azure DevOps. This data is used to pre-fill context files stored locally. The process is transparent, requiring user confirmation for all gathered data, and no network exfiltration to unauthorized domains is present.
  • [PROMPT_INJECTION]: The skill incorporates defensive measures against indirect prompt injection. It generates a 'Safety' section in the user's configuration files that explicitly instructs consuming agents to treat the context files as data, disregard any embedded instructions (like 'ignore previous instructions'), and prioritize safety over any directives found within the user's personal context.
  • [SAFE]: The skill's operations, including file system writes, directory creation, and the modification of agent configuration files, are within the expected scope of a setup and configuration tool. It follows security best practices by recommending local storage, warning against the storage of credentials, and implementing a backup system for existing files.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 07:12 AM
Security Audit — agent-trust-hub — setup-my-iq