best-practices-researcher
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a structured methodology for technical research and code quality auditing. It emphasizes version-aware guidance and grounded information rather than relying solely on pre-trained model data.
- [DATA_EXFILTRATION]: The skill accesses project manifests (such as package.json, go.mod, and requirements.txt) and linting configurations to identify technology stacks and project conventions. This activity is restricted to standard metadata files required for its function and does not target sensitive user data, SSH keys, or cloud provider credentials.
- [PROMPT_INJECTION]: The skill ingests data from external sources, including web search results and user-supplied code, which presents a surface for indirect prompt injection.
- Ingestion points: Web search results for landscape analysis (Step 2), user-provided code for auditing (Mode 3), and project configuration files (Mode 2).
- Boundary markers: The instructions do not specify explicit delimiters or instruction-bypass warnings for the ingested data.
- Capability inventory: The skill uses platform web search capabilities and is permitted to write documentation files like
GROUNDED_PRACTICES.mdand ADR documents. - Sanitization: No specific filtering or sanitization steps are defined for the data retrieved from external sources.
Audit Metadata