skills/mimukit/skills/repokit/Gen Agent Trust Hub

repokit

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Utilizes the GitHub CLI (gh) and Git to manage repository metadata and local file state. These operations are restricted to the current repository context and include preflight checks for authentication and tool presence.
  • [EXTERNAL_DOWNLOADS]: Fetches the official MIT license text from GitHub's public API. This download originates from a well-known service and is used solely for project scaffolding.
  • [INDIRECT_PROMPT_INJECTION]: Analyzes project documentation and manifests to infer repository descriptions and topics. This represents an ingestion surface for untrusted data; however, the skill mitigates risks by presenting all proposed changes to the user for confirmation and enforcing strict schema validation on the output (e.g., topic formatting).
  • Ingestion points: README.md, package.json, pyproject.toml, and other project manifests.
  • Boundary markers: No explicit delimiters are specified for wrapping external content during inference.
  • Capability inventory: Mutates repository state via gh repo edit and gh label, and writes/renames local files using Write and git mv across multiple mode scripts.
  • Sanitization: Enforces lowercase, alphanumeric characters, and hyphens for generated GitHub topics.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 06:37 PM