Skills
skills/aradotso/ai-agent-skills/launch-your-agent-claude-code/Gen Agent Trust Hub

launch-your-agent-claude-code

Pass

Audited by Gen Agent Trust Hub on Jul 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The installation instructions utilize git clone to fetch the skill's core logic from a trusted organization's repository on GitHub.
  • [COMMAND_EXECUTION]: The skill generates and executes a local shell script (launch.sh) and uses curl to interact with the Anthropic API for agent deployment and environment management.
  • [DATA_EXFILTRATION]: The skill performs network operations directed at api.anthropic.com. This is a well-known service and is necessary for the skill's primary function of managing agents on the Anthropic platform.
  • [PROMPT_INJECTION]: The eval.js component presents an indirect prompt injection surface as it ingests untrusted output from agent runs and interpolates it directly into a grading prompt.
  • Ingestion points: The gradeRun function in my-agent/eval.js ingests the output field from an agent run.
  • Boundary markers: No delimiters or instruction-bypass warnings are present in the gradePrompt template.
  • Capability inventory: The skill possesses file-writing capabilities (creating configuration files), network access (via curl to the Anthropic API), and shell execution (launch.sh).
  • Sanitization: The skill does not implement sanitization or escaping for the external content before interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 2, 2026, 01:48 AM
Security Audit — agent-trust-hub — launch-your-agent-claude-code