devenv-ecosystem
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface. It is designed to translate natural language user requirements into executable Nix configurations (devenv.nix), which can include shell scripts and automated hooks.
- Ingestion points: User requests describing desired environment tools, scripts, and services (SKILL.md).
- Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore malicious instructions embedded in the user's project descriptions.
- Capability inventory: The skill generates code for scripts, processes, and git-hooks.hooks which can execute arbitrary shell commands on the host system via the exec and entry attributes.
- Sanitization: Absent. No mention of escaping or validating user-provided strings before they are interpolated into the generated Nix code.
- [COMMAND_EXECUTION]: Provides templates for defining background processes and shell scripts (e.g., scripts.build.exec, processes.web.exec). These are legitimate features of the devenv tool but facilitate the execution of shell commands through the AI agent.
- [SAFE]: The skill includes explicit security guidance in the anti_patterns section, specifically advising against storing production secrets in the env attribute and recommending the use of .env files and .gitignore instead.
Audit Metadata