quasar-foundation
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (
suggest_next_skill.py) to provide workflow recommendations. This script relies onscripts/_skill_cli.py, which usessubprocess.runto execute commands. The implementation follows security best practices by passing arguments as a list and not enabling shell mode, minimizing the risk of command injection. - [EXTERNAL_DOWNLOADS]: The documentation references standard installation commands for the Quasar framework and its official plugins via the
npmregistry. These are well-known, legitimate resources within the Vue.js ecosystem. - [INDIRECT_PROMPT_INJECTION]: The suggestion script (
suggest_next_skill.py) accepts a project root path as an argument to analyze the local environment. While processing project files introduces a theoretical surface for indirect prompt injection, this is a standard operational pattern for development tools and is used here for non-critical navigational assistance.
Audit Metadata