tek-setup-board
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests the current Git branch name to populate a project file. While this is an external data ingestion point, the source is local repository metadata.
- Ingestion points: Git repository branch metadata (SKILL.md).
- Capability inventory: File system writes to
card-loop/board.mdand Git command execution. - Boundary markers: None explicitly used for the branch name string.
- Sanitization: None described for the branch name input.
- [COMMAND_EXECUTION]: The skill requires the agent to perform environment checks using Git commands (such as verifying a repository exists and identifying the active branch). These are standard operations for repository management and align with the primary purpose of the skill.
Audit Metadata