setup-agent-config

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill implements a PreToolUse hook via llm-test-flags.sh that intercepts bash commands. It specifically targets test runners like Vitest, Jest, and Bun to remove the --verbose flag, which is a common practice for reducing agent token consumption. The script uses jq to safely parse and reconstruct the tool input JSON.
  • [DATA_EXFILTRATION]: No network activity or unauthorized data access was detected. The llm-env.sh script correctly utilizes the $CLAUDE_ENV_FILE environment variable for configuration persistence, which is a standard platform feature.
  • [REMOTE_CODE_EXECUTION]: All execution logic is contained within the provided local shell scripts. There are no external dependencies downloaded or executed from the internet.
  • [PROMPT_INJECTION]: The skill mentions injecting project state (git status, rules, etc.) via UserPromptSubmit hooks to provide the agent with more context. While this increases the prompt surface area, it is used here for legitimate context augmentation and follows established optimization patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 09:06 AM
Security Audit — agent-trust-hub — setup-agent-config