conformetry-configure
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation instructs the agent on using CLI commands such as
conformetry templatesandnx syncto manage template generators and synchronize project configurations. - [DYNAMIC_EXECUTION]: The validation logic for Python files requires spawning a
python3subprocess to perform syntax tree comparisons, which is a functional requirement of the documented tool. - [EXTERNAL_DOWNLOADS]: The skill links to external example configurations and documentation hosted on a GitHub repository (
github.com/JimmyPaolini/codebase) belonging to the author. These are identified as legitimate vendor resources for instructional purposes. - [INDIRECT_PROMPT_INJECTION]: The tool processes external template files and user-defined inputs, creating a vulnerability surface if these files originate from untrusted sources.
- Ingestion points: Template folder contents and
inputsdefined as JSON Schema fragments in the configuration. - Boundary markers: The documentation does not specify explicit boundary markers or delimiters for the agent when processing these files.
- Capability inventory: The system performs file writing during generation and spawns subprocesses for language-specific validation.
- Sanitization: Mustache rendering is described as having HTML escaping disabled by default, which is expected for code generation but requires the user to trust the template source.
Audit Metadata