idea-refine

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No security threats or malicious patterns were detected. The skill is primarily instructional markdown content designed to guide an AI agent through a brainstorming process.
  • [COMMAND_EXECUTION]: The skill includes a shell script scripts/idea-refine.sh intended to initialize a documentation directory. The script is benign, contains no network calls, and uses safe coding practices (e.g., set -e).
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-provided ideas and scan the local filesystem for architectural context using tools like Glob and Grep. While this exposes a theoretical surface for indirect prompt injection via malicious file content or user input, the instructions follow standard agent design for its intended purpose and do not provide a path for privilege escalation or data exfiltration.
  • [REMOTE_CODE_EXECUTION]: Several reference files (e.g., performance-checklist.md, accessibility-checklist.md) mention standard developer tools like npx axe-core, npx pa11y, or npx lighthouse. These are documented as suggestions for developers and are not executed by the skill itself.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 06:54 AM
Security Audit — agent-trust-hub — idea-refine