fable5-best-practice
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or executable code detected. The skill consists entirely of instructional documentation and best-practice templates for agent orchestration.
- [EXTERNAL_DOWNLOADS]: The documentation mentions the installation of the OpenAI Codex plugin for Claude Code (
codex@openai-codex). This is a reference to a well-known and trusted service provider and is presented as a user-approved setup step, which is considered safe. - [PROMPT_INJECTION]: The skill involves processing untrusted data (user intent and repository source code) but incorporates defensive prompting strategies to mitigate risks:
- Ingestion points: Data enters the context via user interviews, repository exploration, and outputs from delegated subagents.
- Boundary markers: The skill explicitly instructs agents to define and respect 'Allow/Deny' boundaries for files, tools, and systems to limit autonomous scope.
- Capability inventory: The agent context includes file system access, tool calling, and subagent delegation (Sonnet, Opus, and Codex).
- Sanitization: The workflow relies on independent 'fresh-context' verifier agents to perform acceptance checks, ensuring that executed work is validated outside the original execution context.
Audit Metadata