project-init
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides installation instructions utilizing
npxto download and install components from the author's GitHub repository (github.com/peter-tu-zynkr/zynkr-skill-builder). This is documented as a standard vendor-specific deployment method. - [COMMAND_EXECUTION]: The skill uses local shell commands for file integrity verification (
shasum) and executes a bundled Python script (scripts/pm-schema.py) to validate project spreadsheet structures against defined schemas. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied metadata, such as project names and objectives, and interpolates this data into Google Drive templates. While the skill lacks explicit input sanitization markers for these values, it operates within a fixed schema and verifies its own internal knowledge sources before execution.
Audit Metadata