create-project-bot
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project-level instructions and role conventions to populate bot identity templates, creating a surface for potential instruction injection.\n
- Ingestion points: Reads external project instructions, existing role bootstraps, and factual records from the file system (SKILL.md, references/existing-role.md).\n
- Boundary markers: Markdown templates in assets/profile-templates.md lack explicit delimiters or instructions to ignore embedded commands within interpolated content.\n
- Capability inventory: Operations are restricted to reading and writing local files within the project root; no network or arbitrary code execution capabilities are defined.\n
- Sanitization: Instructions require JSON escaping for metadata fields but do not include sanitization for natural language instructions in generated markdown files.\n- [PERSISTENCE]: The skill creates a durable .bot directory within the project tree to maintain bot identity, memory, and operating guidance across sessions.\n- [COMMAND_EXECUTION]: References the use of the bb CLI tool for provisioning, environment management, and contact operations within supported harnesses.
Audit Metadata