builder
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines a professional 'Core Contract' for software development, mandating input validation at boundaries, the use of branded types for domain IDs, and result-based error handling instead of process-crashing throws.
- [COMMAND_EXECUTION]: While the skill provides patterns for generating CLI and TUI tools that execute system commands, these are strictly presented as best-practice templates for developers. Instructions emphasize security measures such as avoiding shell injection and detecting TTY environments to prevent hangs in automated pipelines.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs the agent to avoid hard-coding secrets, providing specific implementation patterns for externalizing credentials through environment variables (e.g.,
GEMINI_API_KEY) and secure vaults. - [PROMPT_INJECTION]: The static analysis warning for [PI_CONCEALMENT] in
cli-design-anti-patterns.mdis a false positive. The document describes standard security practices for TUIs (Terminal User Interfaces), specifically recommending that sensitive input like passwords should not be echoed to the screen to prevent shoulder surfing.
Audit Metadata