init-new
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill performs environment discovery using standard diagnostic commands such as
cat,git worktree list,which gh, andgit remote -vto identify project structure, existing configurations, and available CLI tools. - [INDIRECT_PROMPT_INJECTION]: The skill surveys the codebase and ingests data from manifest files and third-party AI instruction files (e.g.,
.cursorrules,.windsurfrules,.clinerules) to automate project setup. - Ingestion points: Survey of project manifest files and existing AI-related rule files in Phase 2.
- Capability inventory: Capability to write new instruction files (SKILL.md, CLAUDE.md) and configure automated shell hooks in
.claude/settings.json. - Sanitization: A mandatory human review checkpoint is included in Phase 3, requiring the user to approve the synthesized proposal before any files or hooks are written.
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of official platform plugins from the
claude-plugins-officialregistry. These are well-known official resources within the platform ecosystem.
Audit Metadata