god-build
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill executes 'npx -y godpowers@7', which downloads and runs a package from the NPM registry at runtime without manual confirmation.- [COMMAND_EXECUTION]: The skill runs a variable verification command supplied via project metadata (PLAN.md or STATE.md) as a shell process.- [INDIRECT_PROMPT_INJECTION]: The skill ingests and follows instructions from untrusted project files which drive its development and execution logic.
- Ingestion points: STATE.md and PLAN.md (Step 1).
- Boundary markers: None detected.
- Capability inventory: File system writes, subagent spawning, and shell command execution (npx).
- Sanitization: No explicit validation of file content before processing.
Audit Metadata