project-workflow
Pass
Audited by Gen Agent Trust Hub on Feb 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily a documentation and process template. All analyzed content consists of markdown templates, architectural diagrams, and standard development checklists.- [COMMAND_EXECUTION]: Phase 1 and Phase 6 include shell command snippets for project initialization (e.g.,
mkdir -p,npm ci,npm run build). These are transparent, standard setup commands for full-stack web development and do not include obfuscation or malicious redirection.- [EXTERNAL_DOWNLOADS]: The CI/CD section (Phase 10) references official GitHub Actions from the 'actions' organization (e.g.,actions/checkout@v4,actions/setup-node@v4). These are well-known, trusted sources used for standard automation workflows.- [INDIRECT_PROMPT_INJECTION]: The skill permits theWebFetchtool for market research in Phase 2. While this allows the ingestion of external data, the skill is a static template and does not define unsafe interpolation or automated execution of the fetched content. Boundary markers and sanitization are the responsibility of the implementer using the template.
Audit Metadata