supervise-this

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill and its required delegation targets are installed from the author's GitHub repository.
  • Evidence: INSTALL.md provides instructions to install the skill using npx skills add RuralNative/RuralNative-SKILLS --skill supervise-this. This targets the official repository associated with the skill's author.
  • [COMMAND_EXECUTION]: The skill performs repository verification by executing a sequence of standard development commands during its verification phase.
  • Evidence: SKILL.md specifies the execution of npm run format && npm test && npm run lint && npx tsc --noEmit && npm run docs:check && npm run build. These commands are standard practices for validating code quality and integrity in a development environment.
  • [PROMPT_INJECTION]: The skill ingests data from GitHub issue comments and descriptions, creating an indirect prompt injection surface.
  • Ingestion points: SKILL.md identifies that the supervisor reads task specifications and model configurations from "structured parent comments" on GitHub issues during the resume and recovery phases.
  • Boundary markers: The skill implements a mandatory approval gate where the user must confirm the "exact resolved planning, implementation, and review selections" before any session is created. It also utilizes "ELI18" decision prompts to resolve ambiguous or missing configuration data.
  • Capability inventory: Capabilities are limited to starting delegated local sessions for planning/implementation and executing the repository verification scripts mentioned in the command execution finding.
  • Sanitization: All model names and variants are revalidated through the agent_manager_models resolution service before they are used to route work to agents.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 10:45 PM