stac-quickstart
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Installation instructions in
references/setup-checklist.mddirect users to pipe remote scripts to the shell (bashorpowershell). These resources are hosted on the official StacDev GitHub organization repository. - [EXTERNAL_DOWNLOADS]: The skill downloads installation and configuration files from
https://raw.githubusercontent.com/StacDev/install. As these resources belong to the vendor's own infrastructure, this behavior is documented as standard setup functionality. - [INDIRECT_PROMPT_INJECTION]: The validation logic in
scripts/validate_project_layout.pyingests content from local files to verify project structure and framework usage. - Ingestion points: The script reads
pubspec.yaml,lib/main.dart, and all.dartfiles within thestac/directory. - Boundary markers: None; content is read directly from files for regex processing without using specific delimiters.
- Capability inventory: The skill includes shell scripts for environment verification and a Python script for layout validation.
- Sanitization: No sanitization is performed on file contents before processing.
Audit Metadata