skill-auditor
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to run Python scripts within the directory of the skill being audited (Step 5). This is an essential function for dynamic performance evaluation.
- [DYNAMIC_EXECUTION]: The scripts/evaluate_skill.py utility uses the Python compile() function to check for syntax errors in the audited scripts. This is a non-malicious use for static validation of code integrity.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it ingests and processes untrusted SKILL.md files and scripts. The skill includes built-in security checks to mitigate this risk by scanning for injection patterns in the audited content.
- [OBFUSCATION]: Defensive obfuscation via string concatenation is used in the security scanner regex patterns to prevent the tool from flagging its own source code during analysis.
Audit Metadata