skill-status-sync
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the Bash tool to run
jq,grep, andmvfor local file processing. It employs safe patterns such as usingjq --argto bind variables, which effectively prevents shell injection vulnerabilities by ensuring that user or task-specific data is treated as data rather than executable code.\n- [DATA_EXFILTRATION]: All file operations are scoped to local project directories (specs/and.claude/). No network operations (e.g., curl, wget) or access to sensitive global paths (e.g., SSH keys, AWS configuration) were found.\n- [PROMPT_INJECTION]: The skill's instructions are focused on operational logic for status synchronization and do not contain phrases or patterns aimed at overriding safety filters or system behavior.
Audit Metadata