verification-cockpit
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates a
tmux-layout.shscript that automates the creation of tmux panes. These panes are configured to execute various shell commands discovered within the target project, such aspnpm test,cargo test, andlazygit. - [REMOTE_CODE_EXECUTION]: The generated layout script sources external bash libraries located in the user's home directory (
~/.config/shell/bin/lib/verify-launch.shandverify-layout.sh). This behavior establishes a dependency on the local execution environment's shell configuration. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from repository files (such as
AGENTS.md,package.json, andREADME.md) to determine which commands to execute. It lacks explicit boundary markers or sanitization for these extracted commands, relying on the user's environment and workflow for safety.
Audit Metadata