project-workflow

Pass

Audited by Gen Agent Trust Hub on Feb 28, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is primarily a documentation and process template. All analyzed content consists of markdown templates, architectural diagrams, and standard development checklists.- [COMMAND_EXECUTION]: Phase 1 and Phase 6 include shell command snippets for project initialization (e.g., mkdir -p, npm ci, npm run build). These are transparent, standard setup commands for full-stack web development and do not include obfuscation or malicious redirection.- [EXTERNAL_DOWNLOADS]: The CI/CD section (Phase 10) references official GitHub Actions from the 'actions' organization (e.g., actions/checkout@v4, actions/setup-node@v4). These are well-known, trusted sources used for standard automation workflows.- [INDIRECT_PROMPT_INJECTION]: The skill permits the WebFetch tool for market research in Phase 2. While this allows the ingestion of external data, the skill is a static template and does not define unsafe interpolation or automated execution of the fetched content. Boundary markers and sanitization are the responsibility of the implementer using the template.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 28, 2026, 01:43 PM