onboard
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its project context interview process, where user input is persisted in a system-level configuration file.
- Ingestion points: User responses to the 'Intent Capture Interview' (Step 0) are used to generate the project's 'CLAUDE.md' file.
- Boundary markers: The skill does not define any delimiters or provide instructions to the agent to treat interview answers as untrusted data when generating the configuration.
- Capability inventory: The skill uses 'Write' to create/modify project files and 'Bash' to execute shell scripts, providing a high-impact surface for injected instructions to exploit.
- Sanitization: No sanitization, escaping, or validation steps are performed on the user's responses before they are written to the 'CLAUDE.md' file.
- [COMMAND_EXECUTION]: The skill executes local scripts ('install.sh' and 'validate.sh') using the 'Bash' tool. While these are part of the intended setup process for the 'ai-toolkit', the use of '$ARGUMENTS' to define the project path introduces a risk of command injection if the input is not properly handled by the agent before execution.
Audit Metadata