code-quality-setup
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured guidelines for configuring industry-standard code quality, linting, and security tools such as ESLint, Ruff, and Hadolint.
- [EXTERNAL_DOWNLOADS]: The skill references and encourages the use of standard package managers and toolsets (e.g., npm, pip, Trivy, OSV-scanner) for repository maintenance.
- [REMOTE_CODE_EXECUTION]: Instructions in
AGENTS.mddirect the agent to usecompose-agentsmdvianpx. This utility is maintained by the skill author (metyatech) and is utilized for synchronizing rule configurations within the project. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The agent reads and audits project configuration files (e.g.,
package.json,.prettierrc) from the local machine during setup tasks inSKILL.md. - Boundary markers: Absent; the skill relies on the structured nature of the configuration files it manages.
- Capability inventory: Subprocess execution permissions for various linting and validation tools are requested across multiple languages (e.g.,
markdownlint,shfmt,pip-audit). - Sanitization: Not applicable as the skill focus is on generating standard static configuration files with intent-level wording.
Audit Metadata