posix-shell-scripting
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements robust security practices throughout its instructions, particularly regarding input validation and environment isolation.
- [PROMPT_INJECTION]: The 'Instruction Authority' section establishes a clear security boundary by treating all external content, such as source comments, diffs, and tool output, as untrusted data that cannot authorize actions or override policies.
- [CREDENTIALS_UNSAFE]: The 'Secrets and Authentication' section contains strict prohibitions against hardcoding credentials, tokens, or private keys, and provides guidance on using machine-local authentication through non-disclosing tool operations.
- [EXTERNAL_DOWNLOADS]: The skill describes an optional workflow to fetch peer guidance from the author's official GitHub repository. This process includes mandatory verification steps, such as using immutable commit hashes and bounding the retrieval scope, which aligns with secure vendor resource management.
- [COMMAND_EXECUTION]: The instructions provide specific defensive coding patterns to prevent shell injection, such as advising against interpolating variables directly into shell source strings and mandating the use of proper argument vector expansion.
Audit Metadata