grove
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends the use of several third-party utilities for auditing and restructuring, such as
git-sizer(hosted on GitHub) and various npm-based tools likemadge,syncpack, anddepcheck. These downloads are directed toward well-known, reputable sources within the software development ecosystem. - [COMMAND_EXECUTION]: The skill utilizes shell commands for repository organization tasks. This includes creating directory structures (
mkdir), moving files while maintaining history (git mv), and running ecosystem-specific workspace analysis tools (turbo,nx,uv,go,cargo). - [PROMPT_INJECTION]: The skill features a wide ingestion surface, as it is designed to read and analyze local project manifests (e.g.,
package.json,go.mod), configuration files, andCODEOWNERSdefinitions during its audit phase. - Ingestion points: Local repository manifests, configuration files, and directory layouts are read to identify project conventions (as detailed in
references/monorepo-health.mdandreferences/audit-commands.md). - Boundary markers: No explicit delimiters are specified for separating file content from agent instructions.
- Capability inventory: File system operations (
git mv,mkdir) and execution of external audit binaries. - Sanitization: The instructions do not specify sanitization or escaping of the ingested file content.
Audit Metadata