dh-cli-usage
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to resolve and execute local CLI tools using
uv run. These tools, includingcli.pyand various management scripts likerun_bounded.py, are used for DH plan operations and diagnostic checks. The commands are scoped to the skill's installation directory or the active workspace. - [EXTERNAL_DOWNLOADS]: The documentation for MCP connection diagnostics involves using
uvxto download and run thefastmcp-slimpackage. This is a standard procedure for debugging Model Context Protocol server issues and uses a well-known toolchain. - [INDIRECT_PROMPT_INJECTION]: The skill describes an interface for appending tasks using YAML data provided via
stdin. - Ingestion points: External data is ingested through the
plan append-task --stdincommand documented inreferences/command-reference.md. - Boundary markers: The instructions do not define specific delimiters for this input, relying on the YAML structure.
- Capability inventory: The skill has the capability to execute shell commands (
uv run,uvx) and perform repository operations. - Sanitization: There is no explicit sanitization described in the skill instructions; it is assumed the underlying CLI validates the input schema.
Audit Metadata