skills/nogikun/skills/claat-writer/Gen Agent Trust Hub

claat-writer

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches a specific version of the linting tool from the author's GitHub repository (github.com/nogikun/claat) during the document verification stage.
  • [COMMAND_EXECUTION]: Local shell commands are used for text processing. The skill uses sed to create a sanitized version of the documentation for prose checking by removing non-prose metadata lines.
  • [REMOTE_CODE_EXECUTION]: The skill utilizes go run to execute the remote claat-tools utility. This action downloads and runs code from a remote Git repository. As this resource is owned by the skill author and serves the explicit purpose of linting the generated output, it is categorized as a legitimate functional requirement.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from a project's source code and configuration files. Ingestion points: Reads project files such as README, Taskfile, and package.json as identified in SKILL.md. Boundary markers: None explicitly defined to separate untrusted source content from generated instructions. Capability inventory: The skill has the ability to execute shell commands (sed) and run external Go packages. Sanitization: No specific input sanitization or escaping mechanisms are mentioned for the source material.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 08:12 AM