god-init
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y godpowers@7to download and execute code from the NPM registry during project status checks, initialization, and migration tasks. This is a primary function of the skill to manage the environment. - [COMMAND_EXECUTION]: The skill performs multiple shell executions via
npx, includingstatus,migrate,init,verify, anddoctor. It also allows for the inclusion of a user-defined verification command via the--verify "<command>"argument during initialization. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input by capturing project goals and custom verification commands, which are then stored in local configuration files or executed.
- Ingestion points: User-provided goal description for
STATE.mdand user-supplied verification commands for theinitstep. - Boundary markers: No specific boundary markers or sanitization logic are defined for the goal content written to
STATE.md. - Capability inventory: The skill possesses file system write capabilities (
STATE.md,AGENTS.md,CLAUDE.md,.godpowers/) and the ability to execute shell commands vianpx. - Sanitization: The instructions do not specify any sanitization or validation of the user-provided goal text or command strings before they are persisted or executed.
Audit Metadata