run-aligned-delivery

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting untrusted codebase content and research data to generate specifications for subagents.
  • Ingestion points: Reads code, documentation, and research results from the repository and external searches during the self-discovery phase in SKILL.md.
  • Boundary markers: The instructions do not specify explicit delimiters or warnings to ignore embedded instructions when processing external content.
  • Capability inventory: The skill orchestrates subagents with build capabilities and executes system commands for testing and state management.
  • Sanitization: No explicit sanitization or filtering of external content is mentioned before interpolation into prompts.
  • [COMMAND_EXECUTION]: The skill uses shell commands to manage project state and verify work quality.
  • Evidence: The orchestrator executes typecheck, tests, git mv, and git commit to manage waves and verify implementation results.
  • [EXTERNAL_DOWNLOADS]: The skill provides installation instructions via the skills CLI from a vendor-owned repository.
  • Evidence: Instructions in README.md use npx -y skills to add the skill pack from the author's GitHub repository (yigitkonur/skills-by-yigitkonur). This is documented as a standard vendor resource.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 12:28 PM
Security Audit — agent-trust-hub — run-aligned-delivery