forge-ai
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Node.js CLI tool located at a relative path:
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js ai compose --root <repository-root> --json. This results in the execution of local scripts with system-level arguments. - [REMOTE_CODE_EXECUTION]: The skill implements a dynamic instruction loading mechanism. It directs the agent to ignore the current file and follow a 'canonical playbook' located at
../../../.fullstack-forge/skills/forge-ai/SKILL.md. This allows the agent's behavior to be controlled by files external to the skill package, which could be modified by third-party processes or updates.
Audit Metadata