skills/simota/agent-skills/grove/Gen Agent Trust Hub

grove

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends the use of several third-party utilities for auditing and restructuring, such as git-sizer (hosted on GitHub) and various npm-based tools like madge, syncpack, and depcheck. These downloads are directed toward well-known, reputable sources within the software development ecosystem.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands for repository organization tasks. This includes creating directory structures (mkdir), moving files while maintaining history (git mv), and running ecosystem-specific workspace analysis tools (turbo, nx, uv, go, cargo).
  • [PROMPT_INJECTION]: The skill features a wide ingestion surface, as it is designed to read and analyze local project manifests (e.g., package.json, go.mod), configuration files, and CODEOWNERS definitions during its audit phase.
  • Ingestion points: Local repository manifests, configuration files, and directory layouts are read to identify project conventions (as detailed in references/monorepo-health.md and references/audit-commands.md).
  • Boundary markers: No explicit delimiters are specified for separating file content from agent instructions.
  • Capability inventory: File system operations (git mv, mkdir) and execution of external audit binaries.
  • Sanitization: The instructions do not specify sanitization or escaping of the ingested file content.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 03:32 AM
Security Audit — agent-trust-hub — grove