get-up-to-speed
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate development and documentation utility. It follows security best practices for agent-led tasks, including:
- [ISOLATED_WORKSPACES]: Instructions mandate that all operational work and example execution occur within a fresh, dedicated directory (
get-up-to-speed-<target>), preserving existing environment contents. - [LEAST_PRIVILEGE]: The skill explicitly states that actions involving service provisioning or external publishing require separate, specific authorization.
- [DEPENDENCY_MANAGEMENT]: The instructions forbid automatic installation of dependencies and require reporting gaps to the user, preventing silent or unauthorized external software acquisition.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external source code and documentation. While this constitutes an indirect injection surface (where instructions could be hidden in third-party files), the skill's internal workflow and policy—specifically disabling additional model invocations—act as mitigations against multi-step exploitation.
- [DYNAMIC_EXECUTION]: The skill requires the agent to generate and run code examples to verify functionality before delivery. This execution is confined to the isolated workspace and is a standard requirement for creating verified technical guides.
Audit Metadata