orchestrate-project-blueprint
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js scripts such as
init-project-authority.mjsandvalidate-project-authority.mjsto automate project initialization and schema verification. These scripts are limited to the project directory and include path validation logic to prevent directory traversal. - [DATA_EXPOSURE]: The skill's instructions and reference documents (e.g.,
autonomy-and-gates.md) explicitly prohibit the agent from accessing sensitive credentials, environment variables, or performing unauthorized network operations. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided project ideas and reads existing project metadata files. While this creates a processing surface for external data, the skill mitigates risk by using strict JSON schemas, predefined markdown templates, and requiring manual user confirmation for design transitions.
- [SAFE]: The skill demonstrates defensive design by implementing a 'driver-approval' gate, ensuring the AI cannot autonomously mark tasks as accepted or modify global agent configurations without explicit authorization.
Audit Metadata