cook
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from pasted specifications, issues, and repository wiki hits which are processed by agents. 1. Ingestion points: The skill accepts user-supplied specs and issues (SKILL.md) and incorporates wiki hits and glossary files into the context (SKILL.md, Flow section). 2. Boundary markers: The instructions call for using normalize and validate CLIs to check agent-authored JSON before processing. 3. Capability inventory: The skill can execute shell commands via local Python scripts and perform file system writes within the .cheese/ directory. 4. Sanitization: Employs schema validation (e.g., validate_curd_plan) and data normalization to sanitize structured inputs.
- [COMMAND_EXECUTION]: The skill makes extensive use of local shell commands through a bundled Python script to automate the development workflow. Evidence: Frequent calls to python3 skills/cook/scripts/cook.pyz with various arguments like wheypoint-resolve, accept, and worktree are documented across the skill instructions.
Audit Metadata