verification-loop
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes various project-specific shell commands such as npm run build, pnpm build, npx tsc, pyright, ruff, and npm run test. These are standard operations used to verify project integrity and quality.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by analyzing data from the local environment.
- Ingestion points: Processes output from build logs, test reports, and git diff commands in SKILL.md.
- Boundary markers: Lacks explicit delimiters or safety instructions to distinguish project content from system instructions.
- Capability inventory: The environment allows shell command execution, which could be abused if the agent follows instructions hidden in project logs or code comments.
- Sanitization: No validation or sanitization is performed on the ingested tool output.
Audit Metadata