skills/nogikun/skills/claat-build/Gen Agent Trust Hub

claat-build

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs the official claat tool from a trusted GitHub repository associated with the Google organization.
  • [EXTERNAL_DOWNLOADS]: The skill fetches and executes claat-tools directly from the author's (nogikun) repository using the go run command.
  • [COMMAND_EXECUTION]: The skill invokes shell commands such as go run, go install, and claat to manage its build environment and perform document linting and conversion.
  • [DYNAMIC_EXECUTION]: The skill utilizes go run to compile and execute Go code from a remote repository at runtime. This mechanism is the primary way the skill provides its linting and building capabilities and involves code maintained by the skill author.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied Markdown files (manual.md), which constitutes an ingestion surface for untrusted data.
  • Ingestion points: Reading and linting the content of the manual.md file (found in SKILL.md).
  • Boundary markers: No explicit delimiters or boundary markers are defined to isolate the content of the processed files.
  • Capability inventory: The skill possesses the capability to execute shell commands (go run, claat) and write files to an output directory.
  • Sanitization: The skill relies on the internal parsing and validation logic of the claat-tools and claat binaries to safely handle the Markdown input.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 08:12 AM