skf-verify-stack

Warn

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python utility, skf-atomic-write.py, using the system's python3 interpreter. This script is invoked across several steps (01 through 06) to handle file writes for feasibility reports and result contracts.
  • [COMMAND_EXECUTION]: The workflow delegates file parsing tasks to up to 8 concurrent subagents in step-01-init.md and step-03-integrations.md. These subagents are tasked with reading metadata.json and SKILL.md files to extract API surfaces and metadata.
  • [PROMPT_INJECTION]: The skill ingests untrusted architectural and PRD/vision documents provided by the user. These documents are parsed for technology references and integration claims, creating a surface for indirect prompt injection if the documents contain malicious instructions.
  • Ingestion points: User-provided architecture and PRD document paths in step-01-init.md.
  • Boundary markers: None identified; the instructions do not prescribe wrapping the ingested content in delimiters or providing "ignore instructions" directives to the model.
  • Capability inventory: The skill has capabilities to read file system metadata, access skill definitions, and execute local shell commands via Python.
  • Sanitization: No validation or sanitization is performed on the text content of the ingested documents before it is processed for extraction.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 19, 2026, 05:05 PM
Security Audit — agent-trust-hub — skf-verify-stack