spike
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional, providing templates and best practices for technical decision-making and architectural exploration.
- [NO_CODE]: The skill consists entirely of Markdown files. No scripts (Python, JavaScript, shell) or compiled binaries are included, eliminating the risk of direct command execution or malicious logic implementation.
- [EXTERNAL_DOWNLOADS]: No external URLs, package registry references, or remote script download patterns (e.g., curl, wget) were detected.
- [DATA_EXFILTRATION]: The skill does not access sensitive file paths (like ~/.ssh or .env) or perform network operations. It specifies a local directory for reports (
.claude/spikes/), which is standard for agent-based documentation storage. - [PROMPT_INJECTION]: The instructions focus on structured output and time-boxing. There are no attempts to override agent safety guidelines, bypass filters, or hide malicious prompts within the text.
- [OBFUSCATION]: A thorough check for Base64 encoding, zero-width characters, homoglyphs, and hidden text patterns revealed no attempts to conceal malicious content.
Audit Metadata