replication-package

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from external manuscript files (LaTeX, PDF, Markdown) and YAML passport files to map exhibits to source code. This untrusted data is then used to drive automated tasks, including environment capture and report generation.
  • Ingestion points: Manuscript files defined by the user in $0 and metadata files located in quality_reports/passports/.
  • Boundary markers: No specific delimiters or "ignore instructions" markers are defined for the interpolation of manuscript data into the workflow.
  • Capability inventory: The skill possesses the Bash, Write, and Task tools, which allow for shell execution, file modification, and task orchestration.
  • Sanitization: There is no evidence of sanitization or strict schema validation for the data extracted from the manuscript before it is used in the packaging workflow.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to perform language detection and environment profiling. It executes local commands such as pip freeze, renv::snapshot(), and creturn list to capture the state of Python, R, and Stata environments respectively.
  • [DYNAMIC_EXECUTION]: During the assembly phase, the skill dynamically generates a replication tree, a DCAS checklist, and a Dockerfile based on the computational requirements detected during Phase 0 and Phase 2. While this is the intended functionality, generating executable build files (Dockerfile) from automatically detected metadata is a form of dynamic code generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 06:31 PM
Security Audit — agent-trust-hub — replication-package