dev-onboarding-builder
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the Volta version manager using 'curl https://get.volta.sh | bash'. Volta is a well-known developer tool for managing JavaScript environments.
- [COMMAND_EXECUTION]: The documentation template includes various shell commands for environment setup, including 'git clone', 'pnpm install', and 'docker run' for database management. It also provides troubleshooting commands such as 'lsof -ti:5432 | xargs kill' for managing port conflicts and 'rm -rf .next' for clearing build caches.
- [CREDENTIALS_UNSAFE]: The onboarding template includes an example configuration for environment variables with a default password ('password') for a local PostgreSQL database. This password corresponds to the local Docker setup instructions provided in the same guide, representing standard non-sensitive development defaults.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest project-specific details from the user to populate the documentation template.
- Ingestion points: Project configuration details provided during the onboarding builder workflow.
- Boundary markers: The skill utilizes a structured markdown template to encapsulate generated documentation.
- Capability inventory: The instructions involve creating documentation that contains shell commands for version control, package management, and containerization.
- Sanitization: Content is formatted into predefined markdown structures for developer guides.
Audit Metadata