skf-test-skill
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various system commands like
git,grep,awk, andpython3to perform file system operations, text processing, and metadata extraction. These commands are integral to its auditing function and are applied to the local skill package.- [EXTERNAL_DOWNLOADS]: The skill usesnpxto run validation tools (skill-check,tessl). While it attempts to avoid downloads using the--no-installflag during feature probes, the primary execution path forskill-checkdoes not include this flag, potentially resulting in downloads from the npm registry if the package is missing.- [PROMPT_INJECTION]: The workflow relies on subagents to process Markdown files and generate JSON inventories. While instructions to these subagents are prescriptive, the skill includes explicit validation logic and ground-truth spot-checks to ensure the integrity of the results and defend against potential subagent hallucination or manipulation.- [DATA_EXFILTRATION]: No data exfiltration patterns were detected. All analysis and reporting occur locally within the configured project and output directories.
Audit Metadata