start-new-app
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill clones a repository from
https://github.com/queso/context-kit.git. This repository and organization (queso) are not on the trusted sources list, posing a risk of untrusted code execution during project setup. - [PROMPT_INJECTION] (LOW): The skill implements an Indirect Prompt Injection surface by fetching a README from an external source and prioritizing it over local instructions.
- Ingestion points:
https://github.com/queso/context-kit/blob/main/README.mdreferenced in Step 2. - Boundary markers: None; the skill explicitly states the remote README should "take precedence."
- Capability inventory:
git clone,rm -rf,git init,mkdir, and file writing operations. - Sanitization: None; the agent is told to follow the fetched instructions as the "source of truth."
- [COMMAND_EXECUTION] (LOW): The skill executes multiple shell commands including
git clone,rm -rf .git, andgit init. While typical for scaffolding, executing these commands in a directory specified by user input or influenced by external instructions (Step 2) carries inherent risk if the environment is not restricted.
Audit Metadata