Quality Gates
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines templates and instructions for executing various shell commands and development tools for automated code validation, such as linting, type-checking, and building (e.g.,
npx tsc,ruff,cargo check,go vet). These are standard tools used within a software development context. - [INDIRECT_PROMPT_INJECTION]: The skill configures
PostToolUsehooks designed to trigger validation scripts automatically after file modifications. This creates an automated execution surface triggered by file changes. - Ingestion points: Content of files modified via the
EditorWritetools as described in SKILL.md. - Boundary markers: The skill uses fixed command strings in the hook configuration to restrict the execution scope.
- Capability inventory: Capabilities include execution of local shell scripts and various language-specific CLI tools (SKILL.md, references/hook-patterns.md).
- Sanitization: The documentation explicitly advises against adding command-line arguments and instead suggests the script reads from environment variables to mitigate command injection risks.
Audit Metadata