forge-implement
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands for version control (git), repository management (gh CLI), and standard build/test tools (npm, pnpm, pytest, cargo, go, make). These are consistent with its stated purpose of software development.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external issue trackers and plan files. This represents an attack surface where maliciously crafted issue descriptions could attempt to influence the implementation logic.
- [EXTERNAL_DOWNLOADS]: The inclusion of package managers like npm, pnpm, cargo, and go in the allowed-tools list implies the ability to download and install third-party dependencies during the development and testing phases.
Audit Metadata