runner-selection
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements security-conscious practices by explicitly instructing the agent to verify .env files without printing secrets and ensuring test environment configuration points to non-production services.
- [PROMPT_INJECTION]: Potential Indirect Prompt Injection Surface: The skill analyzes untrusted repository files to determine the environment configuration. 1. Ingestion points: Project manifests (composer.json, package.json) and instructions read during the detection phase. 2. Boundary markers: No specific delimiters are defined for content read from the repository. 3. Capability inventory: Executes standard framework commands (Artisan, Composer, Node). 4. Sanitization: The skill uses file content for logic branching rather than direct interpolation into shell commands.
- [EXTERNAL_DOWNLOADS]: The skill manages dependencies via standard package managers like Composer and NPM, which fetch packages from official public registries.
Audit Metadata