skills/papischolz/roadmapsmith/audit/Gen Agent Trust Hub

audit

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute the roadmapsmith CLI tool locally to perform project synchronization and auditing.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for the user to install the roadmapsmith package from the NPM registry and add additional skills from the author's GitHub repository. These are documented as vendor-provided resources for the skill's operation.
  • [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes local project files which could contain malicious instructions intended to influence the agent's behavior during the audit.
  • Ingestion points: Project files accessed via the --project-root . flag in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard instructions found within the project data.
  • Capability inventory: The agent has the capability to execute shell commands to run the roadmapsmith tool.
  • Sanitization: The skill does not define any sanitization or validation steps for the content of the files being audited.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 02:24 AM
Security Audit — agent-trust-hub — audit