repository-bootstrapper-skill
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a conservative 'assume-no-permission' stance for high-risk operations. It explicitly instructs the agent to stop and ask for user approval before writing to non-empty directories, installing dependencies, initializing Git, or performing network operations.
- [COMMAND_EXECUTION]: Includes a repository-local validation script
scripts/validate_skill.py. Analysis of the script shows it performs benign file system checks (file existence, regex matching for frontmatter, ASCII checks) and contains no dangerous subprocess calls or remote execution patterns. - [EXTERNAL_DOWNLOADS]: The README contains a reference to a GitHub repository (
jovd83/project-bootstrapper-skill). As the vendor is the author of this skill, this is considered a standard installation reference and is not a security risk. - [PROMPT_INJECTION]: No malicious prompt injection or bypass patterns were detected. The skill uses instructional language that reinforces safety boundaries and adherence to user-provided architecture plans.
Audit Metadata