kata-setup
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [METADATA_POISONING]: The skill's YAML frontmatter includes a metadata field claiming optimization for a non-existent model 'gpt-6-astra', which is deceptive regarding its intended environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documentation and project instructions, creating a vulnerability surface where malicious content could influence the agent's actions.
- Ingestion points: The skill reads the project root README, existing documentation files, Git status, and build configurations.
- Boundary markers: The instructions do not specify delimiters or warnings to ignore instructions embedded within the processed documentation files.
- Capability inventory: The skill performs file creation (docs/AGENTS.md), file movement (docs/inbox/), and shell command execution (existing documentation check tools).
- Sanitization: While the skill limits content changes to path repairs, it lacks explicit filtering or sanitization of instructions found within the ingested data.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute existing documentation check tools found within the local project environment, which could be exploited if malicious configurations are present.
Audit Metadata