skills/kursku/skills/gsd-new-project/Gen Agent Trust Hub

gsd-new-project

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: Accesses hardcoded sensitive local file paths. The skill references multiple files located in C:/Users/nicol/.codex/get-shit-done/, which is a specific user's directory on a Windows system. Hardcoding paths to user profiles is an unsafe practice that can lead to unauthorized data exposure or access to files outside the intended project environment.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a workflow based on the content of a local file (new-project.md). If this file or the user-provided arguments ({{GSD_ARGS}}) are compromised, it could lead to the execution of malicious logic within the agent's workflow.
  • [PROMPT_INJECTION]: The skill uses specific mapping logic for Task() to spawn_agent(). While this is part of the orchestration design, the lack of sanitization for arguments passed into these tasks creates a surface for potential injection or unexpected agent behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 12:01 PM
Security Audit — agent-trust-hub — gsd-new-project