full-build
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security vulnerabilities or malicious instructions were identified within the skill's logic or documentation.
- [COMMAND_EXECUTION]: The skill facilitates the execution of existing project-defined scripts (tests, linting, building) to ensure code quality. These operations are performed on local files within the project environment and do not involve arbitrary or malicious commands.
- [INDIRECT_PROMPT_INJECTION]: The skill reads project source code and user-provided requirements to generate code and tests. This constitutes a standard surface for indirect prompt injection common to developer-focused AI tools. Ingestion points: Reads local code files and user feature descriptions to map use cases and implement logic. Boundary markers: Absent; no specific separators are used to distinguish project data from agent instructions. Capability inventory: Uses 'todowrite' to create tasks and modifies the local filesystem to create and update files; executes project-defined validation scripts. Sanitization: Not specified; the skill operates under the assumption that the project context and user inputs are trusted for the purpose of feature building.
Audit Metadata