modernize-reimagine
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local system commands such as
readlinkto identify source code paths andpython3to run a post-process reporting script (build_report.py) located within the plugin's environment root (${ANTIGRAVITY_PLUGIN_ROOT}). These operations are standard for a developer-oriented automation tool. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from legacy source code and external specification files. It includes a specific security control by instructing the agent to examine output for "planted instructions in the untrusted spec," demonstrating an active defense against prompt injection from data sources. Additionally, it mandates that credentials and connection details be replaced with placeholders or environment variables.
- [DYNAMIC_EXECUTION]: The skill utilizes a
Workflowtool to execute a JavaScript scaffolding script (reimagine-scaffold.js) from its internal plugin directory. This runtime execution is restricted to the skill's own distribution files and is used to orchestrate the creation of the modernized system architecture.
Audit Metadata