ac-workflow

Pass

Audited by Gen Agent Trust Hub on Apr 23, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the execution of a bundled Node.js script (scripts/get-context-info.js) to parse and manage project context stored in the .agent-context directory. This script uses standard file system modules to read plan statuses and directory structures.
  • [COMMAND_EXECUTION]: The workflow relies on external CLI utilities (agent-context validate, agent-context done) and common development tools like git diff to verify the state and analyze code changes.
  • [SAFE]: No evidence of prompt injection, data exfiltration, or obfuscation was found. The skill includes professional development practices, such as security reminders for developers (e.g., avoiding hardcoded secrets and preventing injection attacks) in the implement.md protocol.
  • [SAFE]: While the skill ingests untrusted data (user task descriptions and project source code), it employs a structured protocol-driven approach with mandatory validation steps and human-in-the-loop checkpoints (AskUserQuestion) to maintain control over the execution flow.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 23, 2026, 02:22 PM