gsd-new-project
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses hardcoded sensitive local file paths. The skill references multiple files located in
C:/Users/nicol/.codex/get-shit-done/, which is a specific user's directory on a Windows system. Hardcoding paths to user profiles is an unsafe practice that can lead to unauthorized data exposure or access to files outside the intended project environment. - [COMMAND_EXECUTION]: The skill instructs the agent to execute a workflow based on the content of a local file (
new-project.md). If this file or the user-provided arguments ({{GSD_ARGS}}) are compromised, it could lead to the execution of malicious logic within the agent's workflow. - [PROMPT_INJECTION]: The skill uses specific mapping logic for
Task()tospawn_agent(). While this is part of the orchestration design, the lack of sanitization for arguments passed into these tasks creates a surface for potential injection or unexpected agent behavior.
Audit Metadata