bootstrap-repository
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted metadata from existing repository files (e.g.,
package.json,pyproject.toml, and GitHub workflow YAML files) via theinspect_repository.pyscript. This data is used to inform the agent's project setup decisions, creating a surface where embedded instructions in those files could influence agent behavior.\n - Ingestion points: The
scripts/inspect_repository.pyscript reads local configuration files and fetches metadata from the GitHub API.\n - Boundary markers: The skill defines structured maturity profiles but does not include explicit instructions for the agent to ignore prompt-like content within the parsed project files.\n
- Capability inventory: Subprocess calls to the
ghCLI inscripts/inspect_repository.pyand various framework generators (e.g.,uv,npx expo) in the instructions.\n - Sanitization: The
inspect_repository.pyscript includes regex validation of the repository name to prevent malformed input from affecting the GitHub CLI call.\n- [DYNAMIC_EXECUTION]: The skill guides the agent to generate project-specific verification commands (such as test runners or build scripts) and then execute them to verify the repository's state.\n - Evidence: The
SKILL.mdinstructions require the agent to "expose one authoritative verification command" and subsequently "run the authoritative command" as part of the verification and reporting process.
Audit Metadata