building-skills
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions guide the agent to use various CLI tools, including
gitfor repository management and theamputility for skill administration, such asamp skill add,amp clone, andamp skills import. - [EXTERNAL_DOWNLOADS]: The skill facilitates the acquisition of external content through Git repository cloning and skill importing from remote URLs. It also mentions using
npxto fetch and run MCP servers from the npm registry. - [DYNAMIC_EXECUTION]: The skill describes how to configure MCP servers that run as standalone processes via shell commands (using
command,args, andenvfields), allowing for the runtime execution of tools defined within the skill frontmatter. - [INDIRECT_PROMPT_INJECTION]: This skill serves as a gateway for importing third-party skills, creating a surface for indirect prompt injection from processed data. It includes a mandatory review process for scripts and configurations, advises on using
includeToolsto filter capabilities to minimum requirements, and emphasizes auditing internet-sourced skills for unexpected network or credential access before they are loaded.
Audit Metadata