forge-code
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script using the command
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js code compose. This command is intended to resolve the necessary runtime composition for the task. - [PROMPT_INJECTION]: The agent is directed to load and strictly follow instructions from an external file located at a relative path (
../../../.fullstack-forge/skills/forge-code/SKILL.md). It also instructs the agent to load paths specified in.forge/composition.json. These patterns move the control logic and agent instructions to files outside the immediate scope of the skill folder.
Audit Metadata