source-driven

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs dynamic context injection using the !command syntax to execute cat package.json when the skill is initialized. This automatically populates the agent's context with the project's dependency list. This is a legitimate use of the platform's features for project-specific tooling.
  • [DATA_EXPOSURE]: The workflow instructs the agent to read local project files, including package.json and source files within the node_modules/ directory. This access is limited to project structure and library definitions required for the skill's stated purpose.
  • [EXTERNAL_DOWNLOADS]: The skill leverages the WebFetch tool to retrieve external documentation. The instructions emphasize fetching specific versioned documentation rather than 'latest' to avoid hallucinations and ensure code compatibility.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 12:09 AM
Security Audit — agent-trust-hub — source-driven