kw-gsd-fortify
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Git commands (
git add,git commit) to persist analysis findings and plan annotations. These commands are restricted to the specific files created or edited by the skill and include a requirement for explicit user confirmation before execution. - [EXTERNAL_DOWNLOADS]: Fetches metadata from
https://ui.shadcn.com/r/index.jsonto verify the availability of UI components. This targets the official registry of shadcn/ui, a well-known and widely used development service. - [REMOTE_CODE_EXECUTION]: Recommends the execution of
npx shadcn@latest add <name>for component installation. While this involves executing external code, it utilizes a trusted community tool and is presented as a guided step for the developer rather than a silent background operation. - [PERSISTENCE]: Uses standard repository commits to maintain the state of planning artifacts (
CONTEXT.md,PLAN.md). This is a transparent persistence mechanism typical for development-oriented AI tools. - [SAFE]: The skill includes safety features such as a 'write-guard' to prevent accidental data loss in planning files and instructions to avoid inventing UI solutions, instead deferring custom component decisions to the user.
Audit Metadata