coding-rules
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill includes references to prompt injection strings (e.g., 'Ignore previous instructions') within its 'Safety Mindset' documentation. These are documented specifically as test cases for evaluating AI system boundaries and are not used as active injection attempts.
- [COMMAND_EXECUTION]: The skill utilizes several local shell scripts to automate project management tasks like indexing the knowledge base and enforcing git safety protocols. These scripts are designed as lifecycle hooks for the Claude Code platform and operate entirely on the local file system.
- [DATA_EXFILTRATION]: No evidence of unauthorized data transmission or network access was found. The skill reads local project metadata solely to maintain session state and provides explicit instructions to the agent to treat its own generated logs as untrusted data to mitigate indirect injection risks.
- [CREDENTIALS_UNSAFE]: The skill provides a defensive pre-commit hook that scans staged changes for secret patterns (e.g., AWS keys, private keys) using local regex checks to prevent accidental leakage. It does not contain, store, or exfiltrate hardcoded credentials.
Audit Metadata