begin
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell commands such as
altitude task --jsonandaltitude bindto manage project state and handle the binding of the local workshop to a remote journey. - [EXTERNAL_DOWNLOADS]: The skill directs the user to install the
@learnaltitude/cliNode.js package from the public registry. This is a vendor-specific tool required to enable the skill's core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill relies on parsing structured JSON output from the
altitudeCLI to determine its operational logic. This establishes a data ingestion surface where the agent's behavior is influenced by external tool output (specifically inSKILL.mdStep 1). - [DYNAMIC_CONTEXT_INJECTION]: The skill leverages platform-specific shell execution features, such as the
!shortcut in Claude Code, and performs immediate environment checks upon invocation to configure the session context.
Audit Metadata