init-dev-agents
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill scans local project metadata files such as package.json, pom.xml, and Cargo.toml to identify the technology stack and directory structure. This information is used solely to generate local documentation (AGENTS.md) and is not transmitted externally.
- [COMMAND_EXECUTION]: The skill includes a step to perform a git commit of the generated documentation. This is an intended functionality of a bootstrapping tool and requires user confirmation.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files (e.g., package names, script commands) to populate templates. While this creates a potential surface for indirect injection, the impact is confined to the content of generated documentation and does not trigger dangerous capabilities.
Audit Metadata