shared-validation-rule
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a verification workflow that uses shell commands to automate unit testing. These commands utilize 'node' to extract package information and 'npm' to execute tests within a specific workspace.
- Evidence: The 'Verification' section in 'SKILL.md' contains bash instructions such as 'npm run test --workspace "$SHARED_PKG" -- --runInBand --runTestsByPath "packages/shared/test/validation/rules/.rule.test.ts"'.
- [DATA_INGESTION_VULNERABILITY]: The skill processes user-supplied inputs (rule names, parameters, and examples) to generate source code and test files. While this creates a surface for potential indirect prompt injection, the skill includes built-in mitigations.
- Evidence: The skill takes several inputs from the user to define the rule's logic and identity.
- Sanitization: The instructions explicitly mandate the normalization of the rule name to 'kebab-case' before use in file paths or shell commands, effectively sanitizing input and preventing common command injection or path traversal attacks.
- Capability Inventory: The agent has the capability to write files to the 'packages/shared' directory and execute the verification commands provided in the documentation.
Audit Metadata