setup-agent-config
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill implements a
PreToolUsehook viallm-test-flags.shthat intercepts bash commands. It specifically targets test runners like Vitest, Jest, and Bun to remove the--verboseflag, which is a common practice for reducing agent token consumption. The script usesjqto safely parse and reconstruct the tool input JSON. - [DATA_EXFILTRATION]: No network activity or unauthorized data access was detected. The
llm-env.shscript correctly utilizes the$CLAUDE_ENV_FILEenvironment variable for configuration persistence, which is a standard platform feature. - [REMOTE_CODE_EXECUTION]: All execution logic is contained within the provided local shell scripts. There are no external dependencies downloaded or executed from the internet.
- [PROMPT_INJECTION]: The skill mentions injecting project state (git status, rules, etc.) via
UserPromptSubmithooks to provide the agent with more context. While this increases the prompt surface area, it is used here for legitimate context augmentation and follows established optimization patterns.
Audit Metadata