convention-setup
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (
scripts/convention.sh) to perform environment detection, file system scanning, and metadata management. These operations are scoped to project convention discovery and lifecycle management. - [METADATA_POISONING]: The skill includes instructions to stamp generated documents with versioning and content metadata. While instructions appear in metadata fields (SKILL.md frontmatter), they are functional platform configurations and do not exhibit deceptive or malicious intent.
- [REMOTE_CODE_EXECUTION]: Analysis of
scripts/convention.shandSKILL.mdconfirms no remote code execution patterns. All operations use local scripts and standard agent tools for project analysis. - [DATA_EXFILTRATION]: No network operations or sensitive file access patterns were found. The skill operates exclusively on local project source files to extract coding patterns.
Audit Metadata