Skills
Navigate
skills/kevinzai/commander/senior-backend/Gen Agent Trust Hub

senior-backend

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external input through its scaffolding and migration tools.
  • Ingestion points: scripts/api_scaffolder.py loads OpenAPI specifications, and scripts/database_migration_tool.py reads SQL schema files.
  • Capability inventory: scripts/api_scaffolder.py writes generated source code to the filesystem; scripts/api_load_tester.py performs network requests to target URLs.
  • Boundary markers: The tools do not implement explicit delimiters or warnings to ignore embedded instructions within the processed schemas.
  • Sanitization: Input data is transformed using regular expressions, but there is no exhaustive sanitization against sophisticated prompt-based injection in the generated output.
  • [DYNAMIC_EXECUTION]: The scripts/api_scaffolder.py tool generates new executable content (TypeScript/JavaScript files) based on external specification files, which is a standard but noteworthy behavior for scaffolding tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:10 AM