create-verification-skill
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it 'interviews' the repository to determine how to drive the application. An attacker could place malicious instructions in the codebase (e.g., in READMEs, package scripts, or route definitions) that the agent then incorporates into the generated verification skill.
- Ingestion points: Project codebase analysis including dev commands, package scripts, and README files.
- Boundary markers: Absent. The instructions do not define delimiters or ignore-embedded-instructions warnings for the analyzed repo content.
- Capability inventory: Local shell command execution through generated
launch,doctor,drive, andcleanuproutines. - Sanitization: Absent. The skill generates commands directly from observed repo patterns without filtering.
- [COMMAND_EXECUTION]: The skill mandates that the agent execute the generated instructions locally ('Run its own instructions end to end once') to prove the skill before delivery. This results in the execution of shell commands derived from untrusted repository data without prior human review.
Audit Metadata