alreview
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and run the alignfirst package from the npm registry, which is an external source.
- [COMMAND_EXECUTION]: The skill executes the alignfirst command-line tool with the guide review arguments via npx -y.
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to follow guidelines dynamically provided by the external tool's output. 1. Ingestion points: Output from the npx alignfirst command (SKILL.md). 2. Boundary markers: No delimiters or explicit 'ignore embedded instructions' warnings are present. 3. Capability inventory: Command execution via npx (SKILL.md). 4. Sanitization: No sanitization or validation of the tool output is performed before the agent is instructed to follow it.
Audit Metadata