quality-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes instructions in
AGENTS.mdand a verification command in.mwt/config.tomlthat involve shell execution. These commands are used for project linting viamarkdownlint-cliand rule synchronization using the author'scompose-agentsmdtool. - [EXTERNAL_DOWNLOADS]: The skill specifies the use of
npmandnpxto fetch and execute dependencies. Specifically, it referencesmarkdownlint-cli(a well-known linting tool) andcompose-agentsmd(a tool provided by the vendor, metyatech), as well as remote rule definition sources from the author's GitHub repository. - [INDIRECT_PROMPT_INJECTION]: The skill's instructions require the agent to process untrusted external data, such as pull request descriptions, documentation, and API specifications, to generate test matrices and verification reports. While the skill lacks explicit boundary markers for this metadata, the usage is confined to procedural quality management tasks.
Audit Metadata