skills/tkersey/dotfiles/actuating/Gen Agent Trust Hub

actuating

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The test suite in tests/test-auxiliary-discovery.mjs utilizes the Node.js vm module (runInNewContext) to execute synthetic JavaScript code snippets. This is used purely for offline verification of the skill's internal discovery logic against hardcoded test fixtures and does not ingest untrusted external code.
  • [COMMAND_EXECUTION]: Multiple shell scripts (e.g., tests/test-reconciler-contract.sh, tests/test-post-elimination-scenarios.sh) and Node.js scripts are used to orchestrate the internal verification suite. These scripts invoke local tools like node, git, and jaq/jq within the repository environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data such as 'accepted Goals' and 'counterexamples' to drive implementation and review workflows.
  • Ingestion points: SKILL.md and counterexamples.md describe binding to 'accepted source' and user instructions.
  • Boundary markers: The workflow mandates 'Source binding' and 'provenance preservation' to distinguish requirements from proposed means.
  • Capability inventory: Internal test scripts possess subprocess execution capabilities (node, sh).
  • Sanitization: The skill employs a 'Counterexample adjudication' and 'Review-credit admission' process to validate findings before they influence the construction.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 05:42 AM