search-first
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to inspect local configuration files (
~/.claude/settings.json) and local skill directories (~/.claude/skills/,~/.codex/skills/) to identify available tools and MCP servers. While these are configuration paths, the access is scoped to the skill's primary purpose of tool discovery and does not involve exfiltration of credentials or sensitive personal data. - [PROMPT_INJECTION]: The skill presents a surface for Indirect Prompt Injection. It directs the agent to ingest and evaluate data from external sources such as npm, PyPI, and GitHub. Maliciously crafted package descriptions or README files encountered during research could attempt to influence the agent's decision-making or implementation plan.
- Ingestion points: External package registries (npm, PyPI), GitHub code search, and web search results.
- Boundary markers: None explicitly defined in the subagent prompt templates.
- Capability inventory: Subprocess execution (npm, pip, rg, gh), file-system read/write, and subagent invocation.
- Sanitization: No explicit sanitization or validation of external content is mentioned before it is processed by the agent.
- [EXTERNAL_DOWNLOADS]: The workflow encourages the use of package managers (
npm,pip) to install discovered solutions. This is standard developer behavior and the skill includes guidance on evaluating candidates for maintenance, community support, and documentation to mitigate risks associated with untrusted dependencies.
Audit Metadata