setup-environment
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read project-specific manifest files such as Gemfile, docker-compose.yml, and config/database.yml. This creates a surface for indirect prompt injection via user-controlled files. The skill mitigates this by instructing the agent to ignore prose content (READMEs, comments, etc.) and by strictly forbidding the agent from executing commands or accessing filled-in credentials.\n
- Ingestion points: manifest files read by the agent in Step 1 of SKILL.md.\n
- Boundary markers: Present; instructions clearly state the agent should only read specific manifests and avoid acting on other repository content.\n
- Capability inventory: None; the agent is explicitly prevented from executing commands or writing to files.\n
- Sanitization: Absent; findings are summarized for the user.\n- [EXTERNAL_DOWNLOADS]: The runbook and templates include commands for downloading dependencies and utilizing CI components.\n
- Package managers: The skill guides the user to run bundle, yarn, or npm to fetch packages from public registries.\n
- GitHub Actions: The EXAMPLES.md template references official actions for code checkout and Ruby setup from well-known GitHub organizations.\n
- Integrity: CI templates utilize specific commit hashes to ensure the integrity of the downloaded actions.
Audit Metadata