metro-ai-app-builder
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses curl and the GitHub CLI (gh) to fetch skill metadata, machine-readable indices, and configuration files from the open-edge-platform organization's GitHub repositories.
- [COMMAND_EXECUTION]: The orchestrator uses npx to run the skills CLI at a specific version (1.5.23) to list and add delegate skills to the environment, and utilizes bash for repository management.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied business objectives to drive automated discovery and tool execution, creating a potential surface for indirect injection.
- Ingestion points: User descriptions of business outcomes collected in Step 1 (SKILL.md).
- Boundary markers: The procedure requires the agent to present a plan and wait for explicit user confirmation ('go', 'yes', 'approved') before building or installing any resources.
- Capability inventory: Uses bash, git, gh, curl, and npx across its discovery and build procedures.
- Sanitization: Leverages a curated routing table in references/SKILL_CATALOG.md to map natural language intents to a specific set of verified delegate skills.
Audit Metadata