repo-tooling-pro

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides documentation and workflows for using local developer tools (dist/tools.js). It emphasizes correct working directory usage and safe artifact lifecycle management.
  • [EXTERNAL_DOWNLOADS]: References to npm install for dependency management are documented for environment setup. These involve standard interactions with the official npm registry, which is a well-known service.
  • [COMMAND_EXECUTION]: The skill instructs the agent on how to run repository CLI commands (e.g., node dist/tools.js validate-skills, npm run build). These operations are confined to the project workspace and align with the stated purpose of repository automation.
  • [PROMPT_INJECTION]: The skill documentation describes processing repository files (Markdown docs in knowledge-base/ and skills in skills/) to build indexes. While this ingestion of external data constitutes a surface for potential indirect prompt injection, the skill itself defines tooling procedures and does not exhibit unsafe autonomous behavior or bypass safety filters.
  • Ingestion points: knowledge-base/documents/**/*.md and skills/*/SKILL.md processed by build-kb and validate-skills respectively.
  • Boundary markers: Not explicitly defined in the CLI documentation.
  • Capability inventory: File read/write, local command execution (node), and network operations for embeddings via dist/tools.js.
  • Sanitization: Not mentioned in the provided instructional text.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 08:35 PM
Security Audit — agent-trust-hub — repo-tooling-pro