refine
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install a dependency using the command
npx skills add https://github.com/alexandru/skills --skill refinements. This resource is hosted on the author's GitHub repository and represents standard vendor functionality for extending skill capabilities. - [INDIRECT_PROMPT_INJECTION]: This skill possesses an attack surface for indirect prompt injection as it is designed to ingest and process external data in the form of codebases, documentation, and specifications.
- Ingestion points: The workflow in
SKILL.mddescribes reading project instructions, conventions, specifications, and code within a user-defined scope (such as a directory or a branch). - Boundary markers: No specific delimiters or instructions to ignore embedded prompts in the analyzed code are defined.
- Capability inventory: The skill is intended to perform behavior-preserving edits (file writes) and verify them using relevant project tests (command execution).
- Sanitization: No explicit sanitization or validation of the processed code content is mentioned.
Audit Metadata