audit
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
roadmapsmithCLI tool locally to perform project synchronization and auditing. - [EXTERNAL_DOWNLOADS]: The skill provides instructions for the user to install the
roadmapsmithpackage from the NPM registry and add additional skills from the author's GitHub repository. These are documented as vendor-provided resources for the skill's operation. - [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes local project files which could contain malicious instructions intended to influence the agent's behavior during the audit.
- Ingestion points: Project files accessed via the
--project-root .flag in SKILL.md. - Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard instructions found within the project data.
- Capability inventory: The agent has the capability to execute shell commands to run the
roadmapsmithtool. - Sanitization: The skill does not define any sanitization or validation steps for the content of the files being audited.
Audit Metadata