fest-planning

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of a local command-line interface tool (fest) to create directories, manage files, and link project paths. These are standard operations for a scaffolding and workflow tool.
  • [DYNAMIC_EXECUTION]: The skill references a shell initialization pattern eval "$(fest shell-init zsh)". This is a common practice for CLI tools to inject helper functions into the user's shell environment and does not indicate malicious intent in this context.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data via structure files (STRUCTURE.md) and command-line arguments (e.g., --name, --steps). While this represents a surface for data ingestion, the actions are performed by a local binary within the project scope, and no signs of exploitation or safety bypass were found.
  • [SAFE]: All documented behaviors are consistent with the stated purpose of festival and workflow planning. The tool appears to be a legitimate utility for project organization.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 06:03 AM
Security Audit — agent-trust-hub — fest-planning