pragman-shape
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of instructional markdown and configuration files aimed at product management workflows. It does not include any executable code (Python, Node.js, or shell scripts).
- [SAFE]: The instructions include explicit security guardrails. Specifically, in the 'CLI unavailable' section, the agent is directed to recommend handoffs only as unverified information and is strictly forbidden from automatically installing or invoking external providers.
- [SAFE]: Data processing is limited to transforming user-provided ideas into a structured YAML contract format. While it handles untrusted user input, the skill lacks the capabilities (network, file-write, or command execution) required to exploit indirect prompt injection.
- [SAFE]: No obfuscation, hidden URLs, or suspicious remote dependencies were detected across any of the analyzed files. All references (e.g., pragman-router, gstack) are consistent with the skill's stated purpose and author context.
Audit Metadata