code-delivery
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed with a defensive posture, requiring explicit user authorization for all Git mutations and enforcing verification of staged diffs before commits.
- [EXTERNAL_DOWNLOADS]: The documentation mentions installation and update procedures via
npxusing the author's own GitHub repository (github.com/idaibin/aicraft). This is a standard mechanism for skill distribution and follows vendor naming conventions. - [COMMAND_EXECUTION]: The skill facilitates the execution of local Git commands (
git status,git fetch,git commit,git push, etc.) which are necessary for its intended purpose of repository management. - [PROMPT_INJECTION]: The skill processes external repository data which serves as a potential surface for indirect prompt injection.
- Ingestion points: Reads
AGENTS.mdfiles and Git diffs from the local repository (SKILL.md, checklist.md). - Boundary markers: Explicitly instructs the agent to verify the staged diff and obtain direct user approval before performing mutations.
- Capability inventory: Git mutations including staging, committing, and pushing.
- Sanitization: Relies on human-in-the-loop verification and validation commands to ensure the integrity of the delivery process.
Audit Metadata