update-ai-dev-kit
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands to synchronize the local project with the vendor's repository, including
git submodule update,npx skills update, andgit commit. - [REMOTE_CODE_EXECUTION]: The skill fetches code from the vendor's remote repository (
SatanLittleHelper/ai-dev-kit) and executes it locally. This involves running shell scripts and installing new skills or plugins directly from the remote source. - [DYNAMIC_EXECUTION]: Executes bash scripts (
build-agents-md.shandinstall-mods.sh) that are stored within the updated git submodule. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill reads directory structures (
.claude/ai-dev-kit/skills/) and configuration files (marketplace.json) from the updated submodule to determine which additional components to install. - Boundary markers: None identified.
- Capability inventory: Includes shell script execution, package installation via
npx, and plugin management. - Sanitization: No specific sanitization or validation of the remote content's filenames or configuration values is performed before use.
Audit Metadata