shinka-setup

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions include steps to install the shinka-evolve package from PyPI and reference the official GitHub repository for the ShinkaEvolve framework. These resources are associated with the skill's author and the intended tool functionality.
  • [COMMAND_EXECUTION]: The workflow requires the agent to execute shell commands to install dependencies (pip install, uv pip install) and to perform smoke tests on the generated scripts using python evaluate.py.
  • [DYNAMIC_EXECUTION]: The skill generates Python and multi-language scripts (evaluate.py, initial.py) and executes them locally to verify the evaluation harness. This behavior is the primary intended function of the scaffold setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes a framework for LLM-driven code optimization, which creates a surface for instructions to be processed during the evolution loop.
  • Ingestion points: The framework ingests task descriptions and success criteria to guide the evolutionary search in run_evo.py and initial.py.
  • Boundary markers: The skill uses # EVOLVE-BLOCK-START and # EVOLVE-BLOCK-END comments to clearly delimit code regions subject to LLM mutation.
  • Capability inventory: The evaluation harness (evaluate.py) is designed to execute generated code modules or run them via subprocess for non-Python languages.
  • Sanitization: The scaffold itself does not implement sanitization, as it relies on the user-provided evaluation logic and the framework's internal controls during the optimization process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 06:48 PM
Security Audit — agent-trust-hub — shinka-setup