grace-setup-subagents
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill scans for agent configuration files in the current project, user-level global config directories, and neighboring projects to determine the appropriate file format for the shell environment. While this involves reading local configuration metadata, it is a standard part of the scaffolding and environment detection process.
- [INDIRECT_PROMPT_INJECTION]: The skill uses content from local configuration files as templates to infer metadata fields, model names, and tool permissions for the newly generated agents. This creates a surface where a malicious local file could theoretically influence the structure of the scaffolded agents, though the risk is low and inherent to the tool's primary purpose.
Audit Metadata