adapt-framework
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from OpenAPI specifications and project context files to drive code generation and configuration.
- Ingestion points: Phase 1.1 reads metadata from
.context/files and Phase 4.1 synchronizes OpenAPI specifications from remote URLs or local files provided by the user. - Boundary markers: The skill implements a strict phase-based workflow where analysis and planning (Phases 0-2) are performed first, and execution of subsequent phases (Phases 3-9) that involve file writes requires explicit user approval of a generated plan file (
.context/reports/adapt-framework-plan.md). - Capability inventory: The skill performs file system writes, executes local scripts via
bun, and runs network operations usingcurland theghCLI. - Sanitization: The instructions do not define specific sanitization or validation routines for the ingested data before it is interpolated into code templates or configuration files.
- [DYNAMIC_EXECUTION]: The skill generates and modifies various project files, including TypeScript scripts and environment configurations, and then executes them using
bun run. For example, Phase 5.1 adaptsscripts/api-login.ts, which is then executed in Phase 5.3 to mint authentication tokens for the agentic testing flow. - [COMMAND_EXECUTION]: Shell commands are constructed and executed using variables derived from project metadata and user input. Phase 5.3 executes
curlagainst$API_BASE_URLto verify authentication, and Phase 7.2 uses theghCLI to configure repository secrets on GitHub based on the contents of the local.envfile. - [EXTERNAL_DOWNLOADS]: The skill fetches external configuration during the adaptation process. Phase 4.1 uses
bun run api:syncto download OpenAPI specifications from remote URLs or GitHub repositories provided by the user.
Audit Metadata