eval-code-quality
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill triggers
npm run buildandnpx tsc --noEmitto verify project integrity. These operations execute scripts defined in the project'spackage.jsonfile. - [INDIRECT_PROMPT_INJECTION]: The skill reads several project files, creating a potential vector for indirect prompt injection.
- Ingestion points: File content from
spec.md,plan.md,tsconfig.json,package.json, and various source files are ingested. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded prompts within the files being evaluated.
- Capability inventory: The skill has the ability to execute shell commands as part of the build verification process.
- Sanitization: No content sanitization or validation is applied to the data retrieved from local files.
Audit Metadata