validate-idea

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses bash scripts (in SKILL.md) to manage configuration and state in the ~/.superstack/ directory. It also executes system commands like uname and date to gather environment data for its telemetry events.
  • [EXTERNAL_DOWNLOADS]: The skill suggests using npx bird in references/customer-signal-rubric.md to gather external market signals. This command will download and execute code from the npm registry if the package is not already present on the system.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles external data that could be used to influence the agent's behavior.
  • Ingestion points: Project ideas are loaded from .superstack/idea-context.md, and real-time social media signals are retrieved via the bird tool.
  • Boundary markers: No explicit delimiters are used to isolate untrusted content from the skill's core instructions.
  • Capability inventory: The skill has access to subprocess execution (bash) and network requests (curl) in SKILL.md.
  • Sanitization: External content is processed without visible validation or sanitization steps.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 04:47 PM