learning-assistant-builder
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a legitimate project generator. It defines a clear workflow for gathering user requirements and translating them into a functional codebase with human-in-the-loop confirmation before file creation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user input via natural language dialogue and incorporates it into the final project files. While this is the intended purpose, it represents a data ingestion surface.
- Ingestion points: User responses provided during the interactive Q&A workflow described in SKILL.md.
- Boundary markers: The instructions do not define explicit delimiters to separate user-provided content from generated application logic.
- Capability inventory: The agent is instructed to create multiple files, including package.json and platform-specific shell scripts (start.bat, start.sh, start.command, start.ps1).
- Sanitization: No specific sanitization or validation rules for user input are defined in the instructions.
- [DYNAMIC_EXECUTION]: The skill generates standard boilerplate startup scripts (e.g., start.bat, start.sh) intended for local execution by the user. These scripts facilitate basic environment setup (npm install) and development server startup (npm run dev) using Vite.
Audit Metadata