skills/superdesigndev/treg/dev-local/Gen Agent Trust Hub

dev-local

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of local shell scripts and Python modules to manage a development stack.
  • Evidence: Invocations of scripts/dev-local.sh with various subcommands (up, down, logs, etc.).
  • Evidence: Use of uv run python -m treg to start the application server.
  • [EXTERNAL_DOWNLOADS]: The skill manages project dependencies using the uv package manager.
  • Evidence: The skill description mentions that uv sync is executed if the virtual environment (.venv) is missing.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts user-supplied arguments for the CLI, creating a surface for indirect prompt injection if those arguments are processed unsafely by the underlying application.
  • Ingestion points: scripts/dev-local.sh cli <args> (SKILL.md).
  • Boundary markers: None explicitly mentioned in the skill instructions.
  • Capability inventory: Shell command execution via script invocation.
  • Sanitization: Not explicitly implemented in the skill instructions; relies on the underlying shell script/application logic.
  • [DATA_EXPOSURE]: The skill interacts with configuration files but includes explicit measures to protect the user's primary configuration.
  • Evidence: The skill sets HOME=scripts/.dev-home to ensure the local development environment does not overwrite the real ~/.treg/config.json file.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 10:50 PM
Security Audit — agent-trust-hub — dev-local