slate-ar-ship
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external data, including user-supplied arguments and repository source code, which introduces a potential surface for indirect prompt injection. Maliciously crafted content within the files being reviewed could attempt to influence the agent's behavior during automated review or proofing steps.
- Ingestion points: The skill reads from
$ARGUMENTSand files in the "current tree," including temporary directories like.tmp/slate-v2. - Boundary markers: The instructions do not define explicit delimiters to separate untrusted file content from the agent's instructional context.
- Capability inventory: The skill has the ability to execute git commands, run local scripts (e.g.,
finalize-autoresearch.mjs), and invoke companion skills (slate-ar-finalize,slate-ar-gate). - Sanitization: No specific filtering or sanitization of the ingested code is described, relying on the agent's internal guardrails and the requirement for human oversight.
- [COMMAND_EXECUTION]: The skill utilizes shell commands (git) and executes local JavaScript scripts (e.g.,
finalize-autoresearch.mjs) to manage the repository state. These actions are standard for developer tooling and are designed with safeguards that require plain-language user approval before executing permanent mutations like commits or stashing files.
Audit Metadata