spatial-app-onboarding
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and append to project-specific agent guidance files such as AGENTS.md or CLAUDE.md within the current working directory to understand project state and provide continuity. This creates an attack surface where malicious instructions embedded in these files by an attacker could influence the agent's actions during the onboarding or development workflow.
- Ingestion points: The skill explicitly searches for and reads AGENTS.md or CLAUDE.md (matched case-insensitively) at the start of each run to continue from the current project state.
- Boundary markers: There are no explicit instructions to the agent to disregard embedded instructions or use strict delimiters when processing these external guidance files.
- Capability inventory: The skill possesses significant capabilities including project scaffolding via pico-cli, Android device interaction via adb, and full build execution via the Gradle wrapper (./gradlew).
- Sanitization: The skill does not describe any sanitization or validation logic for the content read from workspace guidance files.
- [COMMAND_EXECUTION]: The skill utilizes several command-line tools to perform its primary function of project onboarding. These include pico-cli for project creation, adb for device communication (delegated to a specialized emulator skill), and the Gradle wrapper (./gradlew) for compiling and assembling the project. These tools are used within the scope of legitimate developer workflows for the PICO Spatial SDK.
Audit Metadata