quality-workflow

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes instructions in AGENTS.md and a verification command in .mwt/config.toml that involve shell execution. These commands are used for project linting via markdownlint-cli and rule synchronization using the author's compose-agentsmd tool.
  • [EXTERNAL_DOWNLOADS]: The skill specifies the use of npm and npx to fetch and execute dependencies. Specifically, it references markdownlint-cli (a well-known linting tool) and compose-agentsmd (a tool provided by the vendor, metyatech), as well as remote rule definition sources from the author's GitHub repository.
  • [INDIRECT_PROMPT_INJECTION]: The skill's instructions require the agent to process untrusted external data, such as pull request descriptions, documentation, and API specifications, to generate test matrices and verification reports. While the skill lacks explicit boundary markers for this metadata, the usage is confined to procedural quality management tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 02:35 AM