alignfirst-setup-guide
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs Node.js packages including @paleo/docmap, @paleo/workspace, and @paleo/plans-share. These are official resources from the skill author's organization.
- [COMMAND_EXECUTION]: Executes system-level commands to manage the repository setup. This includes git operations to analyze project history, npm or other package manager commands for dependency installation, and docker compose for local environment orchestration. The skill also performs file system cleanup (rm -rf) when migrating from older versions of the toolset.
- [REMOTE_CODE_EXECUTION]: Provides instructions to install additional agent skills directly from a remote GitHub repository (github.com/paleo/alignfirst) using the npx skills utility.
- [DYNAMIC_EXECUTION]: Employs a Node.js one-liner during the uninstallation phase to programmatically modify the skills-lock.json file.
- [INDIRECT_PROMPT_INJECTION]: Analyzes repository metadata such as branch names and commit logs to deduce project conventions. This extracted information is then used to populate agent instruction files, representing an ingestion surface for untrusted data.
Audit Metadata