verify-before-commit

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various shell commands for project verification, including type-checking (npx tsc, go build), linting (eslint, go vet), and testing (npm test, go test).
  • [COMMAND_EXECUTION]: It executes local Python scripts within the repository (harness/validators/task_lifecycle.py and harness/scripts/code-logger.py) to validate and log task lifecycle transitions.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through the processing of repository files and wiki drafts.
  • Ingestion points: Repository configuration files (package.json, go.mod) and markdown draft documents in llmwiki/wiki/sources/draft/.
  • Boundary markers: Absent; the skill does not use delimiters to isolate content read from external files.
  • Capability inventory: Subprocess execution via shell commands (RUN) and file-write access to the llmwiki/wiki/ directory.
  • Sanitization: Absent; there is no explicit validation or escaping of the content retrieved from the file system before it is processed or interpolated.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 07:24 AM
Security Audit — agent-trust-hub — verify-before-commit