add-agenteq-to-boost-project
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Recommends fetching a remote skill from the vendor's repository (https://github.com/sunchayn/agenteq) to handle project refactoring.
- [COMMAND_EXECUTION]: Executes npx agenteq for project detection and initialization, along with git rm --cached to manage repository tracking of generated configuration files.
- [PERSISTENCE]: Automatically configures project lifecycle hooks by modifying composer.json (post-install-cmd, post-update-cmd) and git hook managers (Husky, Lefthook, pre-commit) to execute synchronization tasks.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Reads and parses project metadata from boost.json, composer.json, and agent-specific files such as CLAUDE.md and .mcp.json (SKILL.md).
- Boundary markers: Implements regex-based filtering to isolate specific blocks (e.g., ), but does not use general boundary delimiters for all imported content.
- Capability inventory: Performs file system writes, modifies build scripts, and executes shell commands (SKILL.md).
- Sanitization: Relies on specific block extraction to separate tool-generated content from manual guidance.
- [DYNAMIC_EXECUTION]: Modifies existing composer scripts and shell-based git hooks to inject runtime execution of the synchronization tool.
Audit Metadata