idea-refine
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security threats or malicious patterns were detected. The skill is primarily instructional markdown content designed to guide an AI agent through a brainstorming process.
- [COMMAND_EXECUTION]: The skill includes a shell script
scripts/idea-refine.shintended to initialize a documentation directory. The script is benign, contains no network calls, and uses safe coding practices (e.g.,set -e). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-provided ideas and scan the local filesystem for architectural context using tools like
GlobandGrep. While this exposes a theoretical surface for indirect prompt injection via malicious file content or user input, the instructions follow standard agent design for its intended purpose and do not provide a path for privilege escalation or data exfiltration. - [REMOTE_CODE_EXECUTION]: Several reference files (e.g.,
performance-checklist.md,accessibility-checklist.md) mention standard developer tools likenpx axe-core,npx pa11y, ornpx lighthouse. These are documented as suggestions for developers and are not executed by the skill itself.
Audit Metadata