Skills
Navigate
skills/tony363/superclaude/sc-principles/Gen Agent Trust Hub

sc-principles

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes subprocess.run to call git status in scripts/shared.py for file discovery and mccabe in scripts/validate_kiss.py for code complexity metrics. These tools are standard for development environments and are used with local file paths.\n- [INDIRECT_PROMPT_INJECTION]: The skill reads and processes Python source code, creating a surface for indirect prompt injection via code comments or strings.\n
  • Ingestion points: scripts/validate_crash.py, scripts/validate_kiss.py, scripts/validate_purity.py, and scripts/validate_solid.py read file contents using Path.read_text().\n
  • Boundary markers: Content is parsed without delimiters or instructions to ignore embedded natural language commands.\n
  • Capability inventory: File reading and local command execution (git, mccabe).\n
  • Sanitization: None; comments and string literals are analyzed as part of the AST but not filtered for malicious prompt patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 08:57 AM