repo-tooling-pro
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and workflows for using local developer tools (
dist/tools.js). It emphasizes correct working directory usage and safe artifact lifecycle management. - [EXTERNAL_DOWNLOADS]: References to
npm installfor dependency management are documented for environment setup. These involve standard interactions with the official npm registry, which is a well-known service. - [COMMAND_EXECUTION]: The skill instructs the agent on how to run repository CLI commands (e.g.,
node dist/tools.js validate-skills,npm run build). These operations are confined to the project workspace and align with the stated purpose of repository automation. - [PROMPT_INJECTION]: The skill documentation describes processing repository files (Markdown docs in
knowledge-base/and skills inskills/) to build indexes. While this ingestion of external data constitutes a surface for potential indirect prompt injection, the skill itself defines tooling procedures and does not exhibit unsafe autonomous behavior or bypass safety filters. - Ingestion points:
knowledge-base/documents/**/*.mdandskills/*/SKILL.mdprocessed bybuild-kbandvalidate-skillsrespectively. - Boundary markers: Not explicitly defined in the CLI documentation.
- Capability inventory: File read/write, local command execution (
node), and network operations for embeddings viadist/tools.js. - Sanitization: Not mentioned in the provided instructional text.
Audit Metadata