bootstrap-repo
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill scans local repository files such as
package.json,pyproject.toml, and existing scaffold documents to detect project metadata. This creates a potential surface for indirect prompt injection if an attacker embeds instructions within these project files. - Ingestion points: The skill reads repository root files and existing documentation in steps 1 and 4 of the workflow described in
SKILL.md. - Boundary markers: The instructions do not specify explicit delimiters or "ignore" warnings when interpolating data from scanned files into the agent's context.
- Capability inventory: The skill possesses file system write capabilities to create or update files within the repository (
SKILL.mdstep 4). - Sanitization: The risk is mitigated by instructions to "Apply templates deterministically" and "Only fill documented placeholders," which limits the agent's autonomy when processing external data.
Audit Metadata