companify-setup
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Node.js script (setup.mjs) included in the package to automate the setup of the .companify and company directories and their associated files.
- [PROMPT_INJECTION]: The skill possesses the capability to modify the project's AGENTS.md file, which serves as the primary source of instructions for the agent. This creates a surface for indirect prompt injection or modification of agent behavior.
- Ingestion points: The script reads AGENTS.md, .companify/company-context.md, .companify/progresso.md, and .brandfy/config.yaml to determine existing state and configurations.
- Boundary markers: The skill implements explicit boundary markers ( and ) to delimit the block of instructions it manages within AGENTS.md.
- Capability inventory: The script has the capability to create directories and write to multiple markdown and YAML files within the project root specified by the agent.
- Sanitization: Content synchronization is performed via regex-based section matching; no specific content sanitization or escaping of the ingested data is performed before it is written back to files.
Audit Metadata