cutagent-setup
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run
npx cutagent setupandcutagent runtime start, which are necessary for tool initialization. - [EXTERNAL_DOWNLOADS]: The
npxcommand downloads thecutagentpackage from the NPM registry, which is a well-known service. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the
cutagent --json statuscommand output. - Ingestion points: Output of
cutagent --json statusin SKILL.md. - Boundary markers: No specific delimiters or safety instructions are provided for the command output.
- Capability inventory: The skill can execute shell commands and discover local files.
- Sanitization: There is no evidence of sanitization for the ingested command output.
Audit Metadata