aldescription
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the alignfirst package from the npm registry. This package is an official resource provided by the skill author, paleo.\n- [COMMAND_EXECUTION]: The skill executes the alignfirst guide description command to retrieve operational instructions.\n- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to follow protocol instructions dynamically retrieved from a command output.\n
- Ingestion points: The output of the alignfirst guide description command as specified in SKILL.md.\n
- Boundary markers: None; the agent is directed to adopt the tool's output as rules.\n
- Capability inventory: The output regulates work file rules and ticket directory structure.\n
- Sanitization: No validation or filtering is performed on the tool's output before processing.
Audit Metadata