validate-idea
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses bash scripts (in
SKILL.md) to manage configuration and state in the~/.superstack/directory. It also executes system commands likeunameanddateto gather environment data for its telemetry events. - [EXTERNAL_DOWNLOADS]: The skill suggests using
npx birdinreferences/customer-signal-rubric.mdto gather external market signals. This command will download and execute code from the npm registry if the package is not already present on the system. - [INDIRECT_PROMPT_INJECTION]: The skill handles external data that could be used to influence the agent's behavior.
- Ingestion points: Project ideas are loaded from
.superstack/idea-context.md, and real-time social media signals are retrieved via thebirdtool. - Boundary markers: No explicit delimiters are used to isolate untrusted content from the skill's core instructions.
- Capability inventory: The skill has access to subprocess execution (bash) and network requests (curl) in
SKILL.md. - Sanitization: External content is processed without visible validation or sanitization steps.
Audit Metadata