cofounder-tech-stack
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands to manage local development, including starting database containers with Podman (
podman run,podman start), compiling Go code (go run,go build), and managing frontend development servers (npm run dev). These are essential for the skill's primary function of scaffolding and running applications. - [EXTERNAL_DOWNLOADS]: The skill downloads and installs software dependencies using package managers, such as Node.js packages via
npm installand browser binaries for visual testing usingnpx playwright install chromium. It also usesmiseto manage and upgrade project tools (Go, Node.js, SQLC) andbrewto upgrade themisetool itself on macOS. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from project documentation files like
docs/PRD.mdto generate tasks and code. This creates a surface for indirect injection where content in the documentation could attempt to influence the agent's code generation or task management. The skill has capabilities for local file writes and command execution, with ingestion points primarily in markdown-based project docs. - [DYNAMIC_EXECUTION]: The skill uses code generation tools like
sqlcto produce Go database code from SQL queries andnpx create-react-routerto scaffold frontend projects. It also generates secrets locally using Python'ssecretsmodule. These behaviors are standard for the development workflow described and do not involve executing untrusted dynamic strings from external sources.
Audit Metadata