shinka-setup
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include steps to install the
shinka-evolvepackage from PyPI and reference the official GitHub repository for the ShinkaEvolve framework. These resources are associated with the skill's author and the intended tool functionality. - [COMMAND_EXECUTION]: The workflow requires the agent to execute shell commands to install dependencies (
pip install,uv pip install) and to perform smoke tests on the generated scripts usingpython evaluate.py. - [DYNAMIC_EXECUTION]: The skill generates Python and multi-language scripts (
evaluate.py,initial.py) and executes them locally to verify the evaluation harness. This behavior is the primary intended function of the scaffold setup. - [INDIRECT_PROMPT_INJECTION]: The skill establishes a framework for LLM-driven code optimization, which creates a surface for instructions to be processed during the evolution loop.
- Ingestion points: The framework ingests task descriptions and success criteria to guide the evolutionary search in
run_evo.pyandinitial.py. - Boundary markers: The skill uses
# EVOLVE-BLOCK-STARTand# EVOLVE-BLOCK-ENDcomments to clearly delimit code regions subject to LLM mutation. - Capability inventory: The evaluation harness (
evaluate.py) is designed to execute generated code modules or run them viasubprocessfor non-Python languages. - Sanitization: The scaffold itself does not implement sanitization, as it relies on the user-provided evaluation logic and the framework's internal controls during the optimization process.
Audit Metadata