econ-review-setup
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill coordinates the execution of a local Python script
setup_econ_review.py(located within the plugin's directory) to configure the user's environment. This includes creating virtual environments and installing local application launchers. - [EXTERNAL_DOWNLOADS]: The setup script is designed to fetch and install version-constrained Python packages from standard registries to fulfill the plugin's dependencies. This is a standard and documented behavior for the tool's primary purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided directory paths (
PROJECT_DIRECTORY) as arguments for shell commands. While this presents an attack surface where a user could provide a malicious path, the skill provides mitigation by enforcing a mandatory dry-run summary and requiring explicit user authorization before execution.
Audit Metadata