framework-development

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs shell command execution via bun run for several verification tasks, including running tests (bun run test), type checking (bun run types:check), linting (bun run lint:check), and framework manifest validation (bun run skills:check).\n- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes project artifacts to drive its automation. 1. Ingestion points: Reads kata-manifest.json, package.json, bun.lockb, and OpenAPI schema files to build context for subagents. 2. Boundary markers: Uses structured briefings for subagents but lacks explicit 'ignore embedded instructions' markers for data file contents. 3. Capability inventory: Possesses capabilities to write files (Phase 2 Code subagents) and execute shell commands (bun run). 4. Sanitization: Implements strict path guardrails defined in kata-invariants.md to prevent modification of sensitive or out-of-scope files.\n- [REMOTE_CODE_EXECUTION]: The skill's readiness preflight gate allows for the installation of missing dependencies using bun install and browser setup via bun run pw:install. While targeting standard registries, these actions involve executing code downloaded from external sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 05:41 PM
Security Audit — agent-trust-hub — framework-development