setup
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill refers the user to a plugin repository hosted on GitHub (
github.com/obra/superpowers). GitHub is a well-known and trusted service for software distribution. - [COMMAND_EXECUTION]: The skill utilizes standard shell commands (
mkdir -p) to create the necessary directory structure for its operations within the project root. These actions are transparent and necessary for the stated purpose of initializing a project configuration. - [INDIRECT_PROMPT_INJECTION]: The skill contains logic to scan local project manifest files (e.g.,
package.json,go.mod,Cargo.toml) to detect the tech stack. - Ingestion points: Tech stack detection occurs by reading common manifest and configuration files in the project root.
- Boundary markers: The instructions do not define explicit delimiters for file content parsing.
- Capability inventory: The skill has the ability to write a YAML configuration file and create directories.
- Sanitization: The skill explicitly mandates validation of the generated configuration against a predefined schema (
references/config-schema.md) before writing to disk.
Audit Metadata