skills-registry
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection because its primary function involves ingesting and processing SKILL.md files from external third-party registries.
- Ingestion points: Configured external registries, including github.com/google/skills and skills.sh.
- Boundary markers: Explicitly requires non-bypassable validation gates (frontmatter validation, slug checks, and security scans) before importing.
- Capability inventory: Performs file system writes to namespaced directories (
agents/skills/ext/) and utilizes local scripts (registry_import.py) for processing. - Sanitization: Implements logic to reject common attack patterns such as pipe-to-shell, obfuscated blobs, and path traversal members.
- [EXTERNAL_DOWNLOADS]: Fetches skill bundles and metadata from configured external registries, including Google's official skills repository and Vercel's skills.sh service.
Audit Metadata