add-new-package
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard commands such as
bun iandbun run make. These are necessary for dependency installation and package building within the monorepo context. - [INDIRECT_PROMPT_INJECTION]: The skill uses a package name provided in the context to create directories and files. This identifies a potential surface for indirect prompt injection, though it is a standard functional component of project scaffolding. 1. Ingestion points: The
<name>placeholder used for path and file content generation. 2. Boundary markers: None identified. 3. Capability inventory: Directory creation, file writing, and command execution (bun). 4. Sanitization: None identified. - [DYNAMIC_EXECUTION]: The skill generates a build script (
bundle.ts) and associated configuration files from internal templates, which are executed during the build process. This follows expected software engineering patterns for project initialization.
Audit Metadata