dotfiles-management
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions direct the agent to execute a local shell script
./install.shto synchronize configurations after making changes in the dotfiles repository. - [COMMAND_EXECUTION]: The skill recommends using
HOMEBREW_NO_REQUIRE_TAP_TRUST=1to bypass interactive security prompts when runningbrew bundle. This environment variable suppresses safety warnings meant to ensure the user trusts third-party package sources. - [PERSISTENCE]: The skill is designed to modify shell configuration files such as
.zshrc. While this is the intended purpose of a dotfiles management skill, modifying shell startup scripts is a standard persistence mechanism used to execute code automatically upon terminal initialization. - [INDIRECT_PROMPT_INJECTION]: The skill manages configuration files that serve as ingestion points for system data. While no explicit injection was found, the lack of defined boundary markers or sanitization for these configuration files represents a potential surface for indirect prompt injection if the agent processes malicious data embedded in such files.
Audit Metadata