sphere-layout-sync
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches layout revisions and contract documentation from the vendor's repository at
https://github.com/go-sphere/sphere-layout.git. These resources are used to update existing projects to newer layout revisions. - [COMMAND_EXECUTION]: Executes project-level build and verification tools via
make(e.g.,make gen/all,make check,make build) to ensure the project remains functional after synchronization. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from external Git commits which could potentially influence agent behavior if the source repository were compromised.
- Ingestion points: Remote Git commits and layout configuration files (
.sphere/layout.json,docs/LAYOUT_CONTRACT.md) as described inSKILL.md. - Boundary markers: Implements a
<HARD-GATE>requiring specific preconditions (lock file presence, SHA resolution, and clean working tree) before proceeding. - Capability inventory: Support for shell command execution through the project's Makefile targets.
- Sanitization: No specific data sanitization is mentioned; the skill relies on standard version control and build tool mechanisms.
Audit Metadata