setup-dev-skills
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill performs standard project initialization tasks, such as reading repository metadata via
git remote -vand writing documentation templates based on user input. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific context files and issue tracker content to inform its configuration tasks. This behavior is consistent with the skill's primary purpose of establishing project conventions and is mediated by user review and confirmation before any persistent changes are made.
- [DYNAMIC_EXECUTION]: The skill includes a local utility script,
check-feature-coverage.mjs, for validating feature coverage in markdown files. This script uses standard Node.js libraries and does not perform any dynamic code generation or remote data execution.
Audit Metadata