setup-project-context
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes command-line tools such as
git,rg(ripgrep), andgh(GitHub CLI) to perform repository analysis. These tools are used to mine commit history, search for code markers (TODOs, HACKs, workarounds), and retrieve issue/PR data to build the project context. - [DYNAMIC_EXECUTION]: The skill facilitates the creation of a new AI agent skill file (
skills/internal/project-context/SKILL.md) by populating predefined templates with repository data. This generated skill acts as a router for the project's documentation domains. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources within the repository, including git commit messages, code comments, and GitHub issue descriptions. This injection surface is mitigated by a mandatory human-in-the-loop 'Interview' phase (Step 4), where the user must provide the 'why' behind any findings before they are committed to the documentation.
Audit Metadata