dev-flow
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust TDD-based development pipeline with explicit safety gates and recovery procedures. It includes helper scripts that manage git tags and branches for checkpoints, which are standard development practices.
- [COMMAND_EXECUTION]: The skill uses local shell scripts for environment management (e.g.,
safety-snapshot.sh,orphan-worktree-check.sh). These scripts perform standard git operations (tagging, branching, logging) and do not involve remote execution, credential access, or privilege escalation. - [DATA_EXFILTRATION]: No network operations or non-whitelisted domain requests were detected. All operations are local to the repository's git structure.
- [PROMPT_INJECTION]: The skill contains 'HARD RULES' and 'Anti-Patterns' intended to guide the AI's behavior toward safer development practices (e.g., prohibiting destructive git commands without approval). These are not malicious overrides but rather safety constraints.
- [EXTERNAL_DOWNLOADS]: The skill does not perform external downloads. It relies on the project's existing local test runners (e.g., Jest, Pytest) and standard toolchains.
Audit Metadata