cofounder-tech-stack

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various shell commands to manage local development, including starting database containers with Podman (podman run, podman start), compiling Go code (go run, go build), and managing frontend development servers (npm run dev). These are essential for the skill's primary function of scaffolding and running applications.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs software dependencies using package managers, such as Node.js packages via npm install and browser binaries for visual testing using npx playwright install chromium. It also uses mise to manage and upgrade project tools (Go, Node.js, SQLC) and brew to upgrade the mise tool itself on macOS.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from project documentation files like docs/PRD.md to generate tasks and code. This creates a surface for indirect injection where content in the documentation could attempt to influence the agent's code generation or task management. The skill has capabilities for local file writes and command execution, with ingestion points primarily in markdown-based project docs.
  • [DYNAMIC_EXECUTION]: The skill uses code generation tools like sqlc to produce Go database code from SQL queries and npx create-react-router to scaffold frontend projects. It also generates secrets locally using Python's secrets module. These behaviors are standard for the development workflow described and do not involve executing untrusted dynamic strings from external sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 02:29 PM