skill-library-mission
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests untrusted data from the repository, including git history, README files, and TODO comments, to drive a multi-agent authoring process without using boundary markers or sanitization to separate data from instructions.\n
- Ingestion points: Phase 1 (Discovery) reads project documentation, build logs, and git history from the local repository.\n
- Boundary markers: Absent; instructions do not specify the use of delimiters or 'ignore' instructions for external content.\n
- Capability inventory: The skill can execute shell commands, perform file system writes (within a specified write fence), and orchestrate other agents.\n
- Sanitization: Absent; repository content is directly folded into agent prompts during the discovery and authoring phases.\n- [COMMAND_EXECUTION]: The workflow requires the agent to extract and execute shell commands found within the target repository to 'verify ground truth'. This behavior could result in the execution of malicious commands if the repository content has been tampered with or contains harmful snippets masquerading as documentation.\n- [COMMAND_EXECUTION]: The skill provides instructions for authoring agents to create and ship executable scripts within the .claude/skills/ directory. These scripts are subsequently executed during the review phase and for provenance maintenance, posing a risk if the generated content is derived from untrusted project data.
Audit Metadata