skf-verify-stack
Warn
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python utility,
skf-atomic-write.py, using the system'spython3interpreter. This script is invoked across several steps (01 through 06) to handle file writes for feasibility reports and result contracts. - [COMMAND_EXECUTION]: The workflow delegates file parsing tasks to up to 8 concurrent subagents in
step-01-init.mdandstep-03-integrations.md. These subagents are tasked with readingmetadata.jsonandSKILL.mdfiles to extract API surfaces and metadata. - [PROMPT_INJECTION]: The skill ingests untrusted architectural and PRD/vision documents provided by the user. These documents are parsed for technology references and integration claims, creating a surface for indirect prompt injection if the documents contain malicious instructions.
- Ingestion points: User-provided architecture and PRD document paths in
step-01-init.md. - Boundary markers: None identified; the instructions do not prescribe wrapping the ingested content in delimiters or providing "ignore instructions" directives to the model.
- Capability inventory: The skill has capabilities to read file system metadata, access skill definitions, and execute local shell commands via Python.
- Sanitization: No validation or sanitization is performed on the text content of the ingested documents before it is processed for extraction.
Audit Metadata