setup-skills
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local repository files and git configuration which could theoretically contain malicious instructions targeting the agent during the setup process.
- Ingestion points: Reads
.git/config,git remote -v,AGENTS.md,CLAUDE.md, and other documentation files during the 'Explore' phase inSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' markers when reading these files.
- Capability inventory: The skill has the capability to write files to the repository (
CLAUDE.md,AGENTS.md, and various files under the{agentRoot}) and execute shell commands via GitHub (gh) and GitLab (glab) CLIs. - Sanitization: The process includes a mandatory step to 'Present findings and ask' the user for confirmation before writing any changes, providing a manual checkpoint to mitigate automated injection.
Audit Metadata