generating-sorbet-inline
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Sorbet type checker via shell commands (
srb tcorbundle exec srb tc) to validate the generated type signatures. It also manages its own state for multi-file processing by creating and removing a temporary tracking file (.sorbet-inline-generation-todo.tmp). These operations are restricted to the skill's stated purpose of type maintenance. - [PROMPT_INJECTION]: The skill involves analyzing and processing Ruby source code, which constitutes an indirect prompt injection surface. The potential risk is mitigated by explicit instructions that constrain the agent to generating signatures and strictly prohibit the execution of any Ruby code from the project environment.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and source code from established services, including the official Sorbet documentation and the Shopify Packwerk repository on GitHub. These are well-known technology resources and are provided for instructional reference without involving untrusted remote execution.
Audit Metadata