maintain
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runextensively across multiple scripts (upgrade-check.py,risk_move.py,settings-rules.py) to execute shell commands such asgit,gh(GitHub CLI), and various shell scripts for project management. - [DYNAMIC_EXECUTION]: Scripts like
upgrade-check.pyandold-skill-pointers.pyuserunpy.run_pathto dynamically execute sibling Python scripts at runtime. This is used for modularizing maintenance tasks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes various project files including
plan.md,AGENTS.md, andmasterplan.mdto drive maintenance routines. - Ingestion points: Reads these Markdown and JSON files to identify outdated records, pieces to be converted to issues, or missing safety settings.
- Boundary markers: The skill instructions explicitly require human approval before applying changes and recommend using clean Git checkpoints.
- Capability inventory: Significant capabilities including file system modification (writing/deletion) and network communication via system tools.
- Sanitization: Employs path traversal protection via the
real_insidefunction inkit-leftovers.pyto ensure operations are confined to the project directory. - [EXTERNAL_DOWNLOADS]: The skill performs update checks against the official
gwpicard/ai-build-kitrepository on GitHub and suggests usingnpxto fetch updates. These references target the skill's own vendor infrastructure and are used for legitimate update procedures.
Audit Metadata