create-formal-verification-skill
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process the local codebase as input to identify verification targets.
- Ingestion points: Repository code files are read to determine where bugs cost the most (SKILL.md).
- Boundary markers: The instructions do not specify explicit delimiters or warnings when processing the ingested code.
- Capability inventory: The skill can write files (generating a project-local skill) and execute shell commands (running verification tools) as described in SKILL.md.
- Sanitization: No explicit sanitization or filtering of codebase content is performed before processing.
- [DYNAMIC_EXECUTION]: The skill instructs the agent to generate a project-local skill and then immediately execute it to prove functionality.
- The agent generates a new skill file based on its codebase analysis.
- The agent is then instructed to follow the steps in the new skill, which includes running verification commands on a "scratch change" to ensure the check can fail (SKILL.md).
Audit Metadata