setting-up-projects
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches pre-commit hooks and quality tooling from well-known GitHub repositories including Astral-sh, Yelp, and the Pre-commit organization.
- [COMMAND_EXECUTION]: Runs shell commands to manage packages and initialize project environments using tools like pip, npm, and pre-commit.
- [DYNAMIC_EXECUTION]: Generates and writes project-specific configuration files (e.g., .editorconfig, .pre-commit-config.yaml) at runtime based on the detected project environment.
- [INDIRECT_PROMPT_INJECTION]: The skill maintains an attack surface for indirect prompt injection by reading project directory structures to inform setup decisions.
- Ingestion points: Analyzes the current workspace using directory listings and git status commands within SKILL.md.
- Boundary markers: No specific delimiters are used to wrap data retrieved from the local environment when generating output or configurations.
- Capability inventory: Features the ability to execute shell commands and perform file system write operations as part of the project initialization process.
- Sanitization: No explicit validation or escaping logic is applied to data ingested from the project files before it is processed.
Audit Metadata