setup
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard Elixir/Erlang toolchain commands such as
mix deps.get,mix ecto.migrate, andmix test. These are expected operations for a project setup playbook and are performed within the local project context. - [DATA_EXFILTRATION]: The skill includes explicit security controls to prevent data exposure. It mandates that no secrets, tokens, or environment-specific URLs be committed to version control and instructs the user to use
.envfiles and redacted connection strings. - [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files like
.tool-versionsand.elixir-version. While these are external inputs that influence agent behavior (version selection), they are standard project metadata and the skill does not interpolate untrusted data into high-privilege execution contexts without human oversight. - Ingestion points: Reads
.tool-versions,.elixir-version, and.env.examplefrom the local workspace. - Boundary markers: None explicitly defined in the prompts.
- Capability inventory: Executes
mixsubprocesses for dependency management and database migrations. - Sanitization: None, as it assumes the developer is working on a trusted or controlled codebase.
- [SAFE]: The skill implements a 'Human-in-the-Loop' (HITL) requirement for destructive operations such as
ecto.dropor force-pushing to a repository, providing a manual safety check against accidental or malicious data loss.
Audit Metadata