agent-friendly
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled local JavaScript file (
node <skill-dir>/dist/index.js) to evaluate the current repository's readiness for AI coding agents. - [PERSISTENCE]: The skill instructs the agent to suggest that users configure their agent to run the skill automatically via session-start hooks, specifically targeting configuration files like
.claude/settings.jsonand.codex/hooks.json. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes content from local repository files (e.g.,
AGENTS.md,README.md, and test files) as input for its scoring logic, creating a vulnerability surface where instructions embedded in those files could influence agent logic. \n - Ingestion points: Local file system access for specific signals including documentation and instruction files (e.g., AGENTS.md). \n
- Boundary markers: None; the agent is instructed to process the resulting JSON output directly. \n
- Capability inventory: The skill possesses the ability to execute shell commands via Node.js. \n
- Sanitization: No mention of input sanitization or validation of the files being scanned is provided in the instructions.
Audit Metadata