skf-test-skill

Pass

Audited by Gen Agent Trust Hub on May 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various system commands like git, grep, awk, and python3 to perform file system operations, text processing, and metadata extraction. These commands are integral to its auditing function and are applied to the local skill package.- [EXTERNAL_DOWNLOADS]: The skill uses npx to run validation tools (skill-check, tessl). While it attempts to avoid downloads using the --no-install flag during feature probes, the primary execution path for skill-check does not include this flag, potentially resulting in downloads from the npm registry if the package is missing.- [PROMPT_INJECTION]: The workflow relies on subagents to process Markdown files and generate JSON inventories. While instructions to these subagents are prescriptive, the skill includes explicit validation logic and ground-truth spot-checks to ensure the integrity of the results and defend against potential subagent hallucination or manipulation.- [DATA_EXFILTRATION]: No data exfiltration patterns were detected. All analysis and reporting occur locally within the configured project and output directories.
Audit Metadata
Risk Level
SAFE
Analyzed
May 11, 2026, 09:53 AM
Security Audit — agent-trust-hub — skf-test-skill