grace-cli
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@osovv/grace-clipackage globally viabunif the binary is not detected on the system. - [COMMAND_EXECUTION]: The skill interacts with the local environment by executing the
gracebinary to perform linting, navigation, and status reporting. - [DYNAMIC_EXECUTION]: The
--run-commandsflag enables the tool to execute shell commands specified in the project'sMustPassCommandassertions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data that could influence its execution flow, specifically via command definitions in project files.
- Ingestion points: Project directories and files processed via the
--pathargument inSKILL.md. - Boundary markers: None identified in the skill instructions.
- Capability inventory: The skill has the capability to execute shell commands defined within the project configuration.
- Sanitization: The documentation indicates that the CLI validates records and schema versions before returning output.
Audit Metadata