project-onboard
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data (including README files, configuration files, and source code) to generate persistent agent instructions. While necessary for its function, this ingestion process lacks explicit content sanitization, which theoretically allows malicious data within a repository to influence the agent's generated guidelines.
- Ingestion points: Phase 1 and Phase 3 scan README files, dependency lists, and the entire codebase for feature auditing.
- Boundary markers: Uses
<!-- generated by project-onboard -->tags to delimit generated blocks in instruction files. - Capability inventory: File system read/write and the ability to suggest
npxcommands to the user. - Sanitization: No specific sanitization or filtering of external strings is mentioned before they are incorporated into summary files.
- [PROMPT_INJECTION]: The skill adopts an autonomous "Discovery" phase and a "quiet" rerun mode. While this is a performance optimization designed to minimize user friction during repetitive tasks, it reduces granular oversight of the file access operations. The skill compensates for this by providing a summary of changed files and audit results at the end of the run.
- [EXTERNAL_DOWNLOADS]: The skill recommends external tools and skills from trusted organizations (e.g., Vercel Labs). These are presented as elective user-facing recommendations rather than mandatory or hidden automated downloads.
Audit Metadata