skills/kirkchen/beat/setup/Gen Agent Trust Hub

setup

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Suggests installing the 'superpowers' plugin from a GitHub repository (github.com/obra/superpowers) if it is missing, which is a common extensibility pattern for this toolset.
  • [COMMAND_EXECUTION]: Uses standard shell commands to prepare the local environment, specifically creating the directory structure required for the tool's operation.
  • [PROMPT_INJECTION]: Accesses project manifest files (e.g., package.json, Cargo.toml, go.mod) to automatically determine the project's technology stack. This represents an indirect prompt injection attack surface, as malicious content inside these untrusted project files could theoretically attempt to influence the agent's configuration logic.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 11:37 AM
Security Audit — agent-trust-hub — setup