skills/stacdev/stac/stac-quickstart/Gen Agent Trust Hub

stac-quickstart

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Installation instructions in references/setup-checklist.md direct users to pipe remote scripts to the shell (bash or powershell). These resources are hosted on the official StacDev GitHub organization repository.
  • [EXTERNAL_DOWNLOADS]: The skill downloads installation and configuration files from https://raw.githubusercontent.com/StacDev/install. As these resources belong to the vendor's own infrastructure, this behavior is documented as standard setup functionality.
  • [INDIRECT_PROMPT_INJECTION]: The validation logic in scripts/validate_project_layout.py ingests content from local files to verify project structure and framework usage.
  • Ingestion points: The script reads pubspec.yaml, lib/main.dart, and all .dart files within the stac/ directory.
  • Boundary markers: None; content is read directly from files for regex processing without using specific delimiters.
  • Capability inventory: The skill includes shell scripts for environment verification and a Python script for layout validation.
  • Sanitization: No sanitization is performed on file contents before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 09:23 AM