shellcheck-configuration
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE] (SAFE): The skill is entirely educational and configurational in nature. All code snippets provided for CI/CD integration, pre-commit hooks, and performance caching follow standard best practices for shell scripting and developer tooling.
- [EXTERNAL_DOWNLOADS] (SAFE): Installation instructions reference the official ShellCheck GitHub repository (
https://github.com/koalaman/shellcheck) and standard system package managers (brew,apt-get). These are trusted sources for the intended purpose of the skill. - [COMMAND_EXECUTION] (SAFE): The provided scripts demonstrate the use of
find,git, andxargsto automate linting. These commands are used as intended for static analysis workflows and do not exhibit dangerous or escalated behavior. - [INDIRECT_PROMPT_INJECTION] (LOW): The skill defines patterns for processing local shell scripts. While processing external code always presents an attack surface for indirect injection (e.g., a script containing malicious comments designed to confuse the agent), the provided examples use standard looping techniques (
while read -r) and boundary-aware tools (shellcheck), which is typical for this category of developer tools.
Audit Metadata