jabraf-dev-setup
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard development tasks such as linting, testing, and type-checking using the project's defined package manager. These operations are restricted to validating the newly configured environment and are typical for development tools.
- [EXTERNAL_DOWNLOADS]: The documentation provides a command for users to install necessary sibling skills from the author's own repository. These references are consistent with the umbrella skill's functionality and the author's namespace.
- [PROMPT_INJECTION]: The skill reads the project's
package.jsonto automatically determine configuration presets (e.g., React or Node.js settings). While reading external files creates a surface for indirect prompt injection, the risk is mitigated by the skill's flow, which presents a consolidated plan and waits for user approval before proceeding. - Ingestion points:
package.json(SKILL.md) - Boundary markers: Not explicitly defined for the JSON data ingestion.
- Capability inventory: Local command execution via package managers and
npx(SKILL.md). - Sanitization: Relies on standard agent processing of structured JSON data.
Audit Metadata