claude-code-setup
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs standard filesystem operations to set up the project structure, including creating directories and setting execution permissions on generated hook scripts.
- [PROMPT_INJECTION]: The skill ingests user-provided strings for project metadata and inserts them into generated documentation and configuration files, creating a potential surface for indirect prompt injection if malicious input is provided.
- Ingestion points: Project name, type, description, and custom instructions collected via user prompts in SKILL.md.
- Boundary markers: Absent; user input is directly interpolated into markdown and configuration templates.
- Capability inventory: File writing, directory creation, and shell command execution via hooks.
- Sanitization: No sanitization of user-provided strings was detected before they are written to the project files.
Audit Metadata