pm-os-setup
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a PowerShell script (
scripts/scaffold-pm-os.ps1) to automate the creation of the workspace structure. The script includes safety checks to prevent overwriting existing files and avoids writing directly into broad system directories like the Desktop or drive roots. It performs routine file operations such as directory creation, file copying, and string replacement for placeholders like{{PROJECT_NAME}}. - [EXTERNAL_DOWNLOADS]: The skill README and scaffolded documentation (e.g.,
skill-librarian.md) mention the optional installation of theskill-creatortool from a trusted source (Anthropic's public skills repository). These references are provided as user instructions and do not involve silent or unauthorized downloads. - [DATA_EXPOSURE]: The skill defines a strict 'operating layer vs. product layer' boundary in its core instructions (
AGENTS.mdandskills/to-prd.md). This architecture is designed to prevent sensitive workspace instructions or agent configurations from leaking into the user's generated product documentation, which is a positive security design pattern for AI workspaces.
Audit Metadata