setup
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, credentials, or remote code execution vectors were identified. The skill facilitates repository setup using local markdown files and human-in-the-loop confirmation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-level documentation and tracker files, which constitutes a vulnerability surface if those files contain untrusted instructions.
- Ingestion points: The agent reads the repository's
AGENTS.md,CLAUDE.md,CONTEXT.md, and any markdown files existing within the.scratch/and.agents/directories. - Boundary markers: The skill uses specific markdown headers (e.g.,
## Agent skills) to locate and update configurations, though it lacks strict delimiters for external content. - Capability inventory: The skill's capabilities are limited to reading and writing markdown files within the local repository path. It does not perform network operations or subprocess execution.
- Sanitization: The skill mandates a "Confirm and write" process, presenting all proposed changes to the user for review and manual editing before any files are written to disk, which serves as a significant mitigation.
Audit Metadata