full-project-skill
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill installs a set of behavioral 'hooks' into the project's '.claude/hooks' directory. These shell scripts (e.g., 'atomic-commit.sh', 'worktree-guard.sh') execute local commands such as 'git diff', 'git commit', and 'git rev-parse' to manage project state and provide automated checkpoints during development.
- [COMMAND_EXECUTION]: A setup utility, 'scripts/setup-hooks.sh', is provided to automate the configuration of these hooks. This script creates necessary directories, copies assets from the skill folder to the project, and modifies the project's '.claude/settings.json' configuration file.
- [COMMAND_EXECUTION]: Documentation assembly is performed by 'scripts/build-docs.ts', which reads multiple source partials and writes the combined output to target files like 'SKILL.md' and 'references/interview.md' using the Bun runtime environment.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design, as it ingests user descriptions during the interview phase and interpolates them into system-level documentation.
- Ingestion points: Interactive discovery interview (Init Step 3) and Update interviews.
- Boundary markers: The templates use structured Markdown headers to separate generated content, though they lack explicit delimiters intended to prevent sub-instruction obedience.
- Capability inventory: The skill possesses file writing capabilities (via 'build-docs.ts') and command execution capabilities (via the installed hooks suite).
- Sanitization: The workflow includes mandatory multi-agent and cross-model documentation reviews (Phases 2.5 and 2.6) to validate content quality and consistency before the user begins implementation.
Audit Metadata