fest-planning
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of a local command-line interface tool (
fest) to create directories, manage files, and link project paths. These are standard operations for a scaffolding and workflow tool. - [DYNAMIC_EXECUTION]: The skill references a shell initialization pattern
eval "$(fest shell-init zsh)". This is a common practice for CLI tools to inject helper functions into the user's shell environment and does not indicate malicious intent in this context. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data via structure files (
STRUCTURE.md) and command-line arguments (e.g.,--name,--steps). While this represents a surface for data ingestion, the actions are performed by a local binary within the project scope, and no signs of exploitation or safety bypass were found. - [SAFE]: All documented behaviors are consistent with the stated purpose of festival and workflow planning. The tool appears to be a legitimate utility for project organization.
Audit Metadata