google-agents-cli-scaffold
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Command Execution: The skill provides instructions for running CLI commands to manage project structure. These commands are essential to the skill's purpose of project scaffolding.
- Indirect Prompt Injection Surface: The skill ingests user input for command parameters, which presents a surface for potential injection. 1. Ingestion points: Project names and configuration flags provided by the user in SKILL.md. 2. Boundary markers: The instructions explicitly mandate requirement clarification and user confirmation before command execution. 3. Capability inventory: The skill uses the environment to execute agents-cli commands. 4. Sanitization: Input is constrained by specific formatting rules for project names (length and character restrictions).
- External Template References: The skill allows for sourcing templates from GitHub repositories. This behavior is documented and follows standard developer workflows for project initialization from remote sources.
Audit Metadata