skills/itsar-vr/goatedskills/build/Gen Agent Trust Hub

build

Pass

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill coordinates various internal tools and sub-skills (e.g., plan, terminus-maximus, browse-qa) using standardized command patterns to automate development phases. These operations are restricted to the local environment and the agent's defined capabilities.
  • [EXTERNAL_DOWNLOADS]: The documentation references the garrytan/gstack repository as a conceptual blueprint for the workflow design. The skill instructions specifically advise against direct installation or mirroring of the external scaffolding, emphasizing a custom local implementation instead.
  • [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection. 1. Ingestion points: The skill accepts a user-provided goal and a target --url for the browse-qa gear. 2. Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided. 3. Capability inventory: The skill can trigger file writes, git commits, and browser interactions via the sub-skill chain. 4. Sanitization: No sanitization of external URL content or goal input is specified. These risks are mitigated by the skill's multi-stage review structure and human-in-the-loop triggers like git status checks.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 7, 2026, 12:56 PM