proposal-check
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed as a read-only diagnostic tool for thesis proposals, explicitly forbidding file modifications during the check process.
- [SAFE]: The inclusion of a SHA-256 digest check provides a mechanism to verify document integrity and detect unexpected file changes during the analysis.
- [SAFE]: The Python script (
scripts/check.py) uses only standard library modules and performs static analysis via regular expressions. It does not contain any remote code execution, dynamic execution of untrusted input, or network communication logic. - [SAFE]: The skill references documentation from the author's official GitHub repository for installation guidance, which is consistent with its intended purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from thesis proposal files and workspace guidelines (
guidelines.md). It does not use explicit boundary markers or sanitization for interpolated data. However, the attack surface is limited to chat-based reporting, as the skill possesses no high-privilege capabilities such as file-writing or network access.
Audit Metadata