analyze-project
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard system utilities including 'find', 'ls', 'tree', 'rg' (ripgrep), and the 'gh' (GitHub CLI) to perform read-only analysis of the project's source code, directory structure, and repository metadata. These commands are used to identify hardcoded configurations, audit CI/CD workflows, and assess dependency health.
- [INDIRECT_PROMPT_INJECTION]: The skill is instructed to ingest and follow instructions from repository-specific configuration files such as 'AGENTS.md' or 'CLAUDE.md'. 1. Ingestion points: Configuration files ('AGENTS.md', 'CLAUDE.md') and documentation ('README.md') within the target repository. 2. Boundary markers: The skill instructions explicitly direct the agent to treat these files as binding authority for the assessment. 3. Capability inventory: Command execution (find, rg, ls, tree), network access via the GitHub CLI (gh), and file read operations. No file-writing or arbitrary network request capabilities are included. 4. Sanitization: No explicit sanitization of the content from these files is performed, though the skill directs the agent to 'reproduce before reporting' and verify findings mechanically rather than relying on claims in the documentation.
Audit Metadata