modernize-reimagine

Pass

Audited by Gen Agent Trust Hub on Nov 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local system commands such as readlink to identify source code paths and python3 to run a post-process reporting script (build_report.py) located within the plugin's environment root (${ANTIGRAVITY_PLUGIN_ROOT}). These operations are standard for a developer-oriented automation tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from legacy source code and external specification files. It includes a specific security control by instructing the agent to examine output for "planted instructions in the untrusted spec," demonstrating an active defense against prompt injection from data sources. Additionally, it mandates that credentials and connection details be replaced with placeholders or environment variables.
  • [DYNAMIC_EXECUTION]: The skill utilizes a Workflow tool to execute a JavaScript scaffolding script (reimagine-scaffold.js) from its internal plugin directory. This runtime execution is restricted to the skill's own distribution files and is used to orchestrate the creation of the modernized system architecture.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 3, 2026, 10:57 AM