bootstrap

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill clones the project's core repository from github.com/pedroromeroluna/ai-first-os to a local directory during the installation process.
  • [REMOTE_CODE_EXECUTION]: Executes the install.sh script downloaded from the author's GitHub repository to configure the local environment and symlink components.
  • [COMMAND_EXECUTION]: Invokes a local bootstrap script (.os/core/lib/bootstrap.sh) to process interview data and generate system files like operator.md and voice.md.
  • [PROMPT_INJECTION]: The skill features an indirect injection surface by incorporating user-provided interview answers into system files processed by shell scripts.
  • Ingestion points: User responses to questions regarding identity, voice, and organizations in SKILL.md.
  • Boundary markers: None present; user input is passed directly to the bootstrap script via an answers file.
  • Capability inventory: Shell script execution (install.sh, bootstrap.sh) and file system write operations across the skill's workflow.
  • Sanitization: No specific sanitization or validation of the interview answers is mentioned before they are processed by the deterministic bootstrap script.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 09:24 PM
Security Audit — agent-trust-hub — bootstrap