repo-boost
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell utilities such as
jq,grep, andbashto implement session hooks in the.claude/settings.jsonfile. These hooks provide automated reminders and safety checks for the agent during the development lifecycle. - [COMMAND_EXECUTION]: Multiple Git commands are executed (
git status,git ls-files,git remote) to audit the project's structure, identify tracked dependencies, and determine the appropriate CLI tools for the repository's hosting provider. - [SAFE]: The skill includes a defensive check for sensitive files (e.g.,
.env,*secret*) usinggit ls-files. This is designed to detect and warn the user if sensitive credentials have been accidentally committed to the Git history. - [SAFE]: The 'Memory Guard' functionality explicitly blocks agents from writing to local hidden directories (e.g.,
~/.claude/projects/.../memory/). This is a security and reproducibility feature that ensures project state is stored in accessible, version-controlled locations. - [INDIRECT_PROMPT_INJECTION]: The skill processes repository metadata and configuration files to populate instructions for the AI agent.
- Ingestion points: Manifest files (
package.json,Cargo.toml), linter configurations, and CI workflow YAMLs in the target repository. - Boundary markers: The generated
AGENTS.mdfile uses standard Markdown headers for structural organization; the template uses<...>placeholders for generated content. - Capability inventory: File writing, Git operations, and shell command execution via agent harness hooks.
- Sanitization: Project-derived facts are subjected to a 'sanity-check' against the codebase, and user confirmation is requested for ambiguous project attributes.
Audit Metadata