quality
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow executes shell commands sourced from project placeholders like
{{LINT_COMMAND}},{{RUN_UNIT_TESTS_COMMAND}},{{RUN_ALL_TESTS_COMMAND}}, and{{SMOKE_TEST_COMMAND}}. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external placeholder data as executable commands.
- Ingestion points: Project placeholder mappings referenced in
SKILL.md. - Boundary markers: No delimiters or "ignore" instructions are used to constrain the execution of the placeholder content.
- Capability inventory: The skill utilizes subprocess execution to run the provided commands.
- Sanitization: The skill does not validate, sanitize, or escape the content of the placeholders before they are passed to the shell.
Audit Metadata