conductor-setup
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill's behavior is consistent with its stated purpose of project initialization through interactive Q&A and local file generation.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes existing project files to pre-populate documentation templates. This is a standard feature for setup tools and is implemented with limited capabilities.
- Ingestion points: The skill reads local project configuration files including
package.json,requirements.txt,go.mod,Cargo.toml,.eslintrc, and.prettierrc(SKILL.md). - Boundary markers: Boundary markers are not explicitly defined for the interpolation of detected data into markdown templates.
- Capability inventory: The skill is restricted to local file reads (
Glob,Read) and file writes within the project directory. It lacks network access, subprocess execution, or dynamic code evaluation capabilities. - Sanitization: No explicit sanitization of ingested file content is mentioned, but the output is restricted to static documentation artifacts.
Audit Metadata