setup
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Executes a local binary named
evolve(or via path in./go/bin/evolve) to detect installed LLM CLIs and confirm setup completion. - [DATA_EXPOSURE]: Manages project-specific configuration by reading and writing model assignment pins to the
.evolve/policy.jsonfile. - [INDIRECT_PROMPT_INJECTION]: The skill processes local documentation files (README.md, architecture docs) and JSON output from the detection binary to generate its recommendations. This creates a surface where the agent's advice is dependent on the integrity of local repository content.
- [SAFE]: The access to
~/.claude/.credentials.jsonmentioned in the caveat is performed by the external detection binary, not directly by the skill instructions, and is a standard check for the tool's functionality.
Audit Metadata