adapt-framework

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from OpenAPI specifications and project context files to drive code generation and configuration.
  • Ingestion points: Phase 1.1 reads metadata from .context/ files and Phase 4.1 synchronizes OpenAPI specifications from remote URLs or local files provided by the user.
  • Boundary markers: The skill implements a strict phase-based workflow where analysis and planning (Phases 0-2) are performed first, and execution of subsequent phases (Phases 3-9) that involve file writes requires explicit user approval of a generated plan file (.context/reports/adapt-framework-plan.md).
  • Capability inventory: The skill performs file system writes, executes local scripts via bun, and runs network operations using curl and the gh CLI.
  • Sanitization: The instructions do not define specific sanitization or validation routines for the ingested data before it is interpolated into code templates or configuration files.
  • [DYNAMIC_EXECUTION]: The skill generates and modifies various project files, including TypeScript scripts and environment configurations, and then executes them using bun run. For example, Phase 5.1 adapts scripts/api-login.ts, which is then executed in Phase 5.3 to mint authentication tokens for the agentic testing flow.
  • [COMMAND_EXECUTION]: Shell commands are constructed and executed using variables derived from project metadata and user input. Phase 5.3 executes curl against $API_BASE_URL to verify authentication, and Phase 7.2 uses the gh CLI to configure repository secrets on GitHub based on the contents of the local .env file.
  • [EXTERNAL_DOWNLOADS]: The skill fetches external configuration during the adaptation process. Phase 4.1 uses bun run api:sync to download OpenAPI specifications from remote URLs or GitHub repositories provided by the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 08:14 PM
Security Audit — agent-trust-hub — adapt-framework