skills/matthewzammit/skills/qol-pass/Gen Agent Trust Hub

qol-pass

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes application-specific shell commands for running, building, and testing the product, which are retrieved from the project's configuration (e.g., .qol-pass/config.json) or discovered in package.json scripts.
  • [COMMAND_EXECUTION]: To perform mobile UI testing, the skill utilizes system tools such as adb for Android (e.g., adb shell svc wifi disable, adb shell settings put system font_scale) and xcrun simctl for iOS (e.g., xcrun simctl ui <udid> appearance dark).
  • [COMMAND_EXECUTION]: The skill integrates with external issue trackers using command-line interfaces like GitHub CLI (gh issue create) or Linear, as defined in the user's configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection by ingesting untrusted project documentation (e.g., docs/, README.md, accessibility guides) to generate quality standards.
  • Ingestion points: Project documentation, package.json, and router files.
  • Boundary markers: None identified.
  • Capability inventory: Shell command execution (adb, xcrun, gh, npm), file writing (findings, configuration, QUALITY.md), and Git operations (commits, branches, pull requests).
  • Sanitization: No specific sanitization or escaping of external content is described.
  • [EXTERNAL_DOWNLOADS]: The documentation provides installation instructions via npx and the Claude Code plugin marketplace, pointing to the author's repositories on GitHub.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 02:57 PM