qol-pass
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes application-specific shell commands for running, building, and testing the product, which are retrieved from the project's configuration (e.g.,
.qol-pass/config.json) or discovered inpackage.jsonscripts. - [COMMAND_EXECUTION]: To perform mobile UI testing, the skill utilizes system tools such as
adbfor Android (e.g.,adb shell svc wifi disable,adb shell settings put system font_scale) andxcrun simctlfor iOS (e.g.,xcrun simctl ui <udid> appearance dark). - [COMMAND_EXECUTION]: The skill integrates with external issue trackers using command-line interfaces like GitHub CLI (
gh issue create) or Linear, as defined in the user's configuration. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection by ingesting untrusted project documentation (e.g.,
docs/,README.md, accessibility guides) to generate quality standards. - Ingestion points: Project documentation,
package.json, and router files. - Boundary markers: None identified.
- Capability inventory: Shell command execution (
adb,xcrun,gh,npm), file writing (findings, configuration,QUALITY.md), and Git operations (commits, branches, pull requests). - Sanitization: No specific sanitization or escaping of external content is described.
- [EXTERNAL_DOWNLOADS]: The documentation provides installation instructions via
npxand the Claude Code plugin marketplace, pointing to the author's repositories on GitHub.
Audit Metadata