check-coverage
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs dynamic command execution by running the tool specified in
$ARGUMENTSwith--helpand through themanutility to gather documentation. - [COMMAND_EXECUTION]: It utilizes the
justcommand runner to execute test suites (just test) and verification checks (just check) after modifying local source code. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it ingests untrusted data from tool help outputs, man pages, and local
tldrfiles. Ingestion points: Documentation gathered from$ARGUMENTS --help,man, andtldrpages (SKILL.md). Boundary markers: Absent. Capability inventory: Writing to source files insrc/dippy/cli/and executing code viajust(SKILL.md). Sanitization: None. Content from these untrusted documentation sources could potentially influence the agent during the code implementation and testing steps.
Audit Metadata