generating-sorbet
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell commands for workflow management and type validation. Evidence includes 'rm .sorbet-rbi-generation-todo.tmp' and 'bundle exec srb tc' in SKILL.md. These operations are restricted to the local environment and support the skill's primary objective.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection vulnerability surface. Ingestion points: Ruby source files are read in Step 1 of the instructions. Boundary markers: Absent. Capability inventory: The skill performs subprocess execution ('srb tc'), file-write operations in the './rbi/' directory, and file-delete operations ('rm'). Sanitization: Absent. Maliciously crafted source code could attempt to manipulate the agent's output.
Audit Metadata