skills/hannsxpeter/godpowers/god-init/Gen Agent Trust Hub

god-init

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx -y godpowers@7 to download and execute code from the NPM registry during project status checks, initialization, and migration tasks. This is a primary function of the skill to manage the environment.
  • [COMMAND_EXECUTION]: The skill performs multiple shell executions via npx, including status, migrate, init, verify, and doctor. It also allows for the inclusion of a user-defined verification command via the --verify "<command>" argument during initialization.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input by capturing project goals and custom verification commands, which are then stored in local configuration files or executed.
  • Ingestion points: User-provided goal description for STATE.md and user-supplied verification commands for the init step.
  • Boundary markers: No specific boundary markers or sanitization logic are defined for the goal content written to STATE.md.
  • Capability inventory: The skill possesses file system write capabilities (STATE.md, AGENTS.md, CLAUDE.md, .godpowers/) and the ability to execute shell commands via npx.
  • Sanitization: The instructions do not specify any sanitization or validation of the user-provided goal text or command strings before they are persisted or executed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 10:40 PM