environment-setup-guide
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download installation scripts from official sources.
- Fetches the Homebrew installation script from its official GitHub repository.
- Downloads the NodeSource setup script for Node.js installation.
- Downloads the Docker installation script from the official Docker domain.
- [REMOTE_CODE_EXECUTION]: Provides commands that execute downloaded scripts to facilitate environment setup.
- Executes the Homebrew installer using
/bin/bashafter a suggested manual review of the script content. - Runs the NodeSource setup script with
sudo -E bashto configure the system package manager. - Executes the Docker installation script with
sudo shfollowing the official installation procedure. - [COMMAND_EXECUTION]: Employs system-level commands necessary for standard development environment configuration.
- Uses
sudo aptfor package management and dependency installation on Linux systems. - Uses
sudo usermodandnewgrpto configure Docker user permissions for host control. - Uses
sudo systemctlto manage the status of installed services like PostgreSQL. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and act upon developer-supplied project requirements and documentation, presenting a standard indirect injection surface.
- Ingestion points: Project documentation, version requirements, and existing configurations defined in the agent's context (SKILL.md).
- Boundary markers: The skill includes high-level guidance but does not implement strict delimiters for untrusted project data.
- Capability inventory: Includes shell command execution (
bash,sh,powershell), file system operations (cp,nano,mkdir), and network operations (curl,git clone,npm install). - Sanitization: The instructions encourage best practices such as manual review of scripts (
cat script # review...) and the use of.env.exampletemplates to avoid secret exposure.
Audit Metadata