create-library

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local shell commands, including cp to initialize settings files and ruby to check for library existence and perform maintenance tasks.
  • [DYNAMIC_EXECUTION]: Step 3 utilizes ruby -e to execute a script snippet constructed from user-provided inputs like library names, languages, and media paths, which is a dynamic execution pattern.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (media paths and library names) that are interpolated into shell commands.
  • Ingestion points: User input for library names and media file paths collected during the interactive questions in Step 2.
  • Boundary markers (absent): The instructions provide normalization for library names but do not specify explicit delimiters or shell escaping for media paths when building the ruby -e command.
  • Capability inventory: The skill has capabilities to copy files (cp) and execute local Ruby scripts.
  • Sanitization (present): Library names are normalized to alphanumeric characters and dashes, and the agent is instructed to verify the existence of all media files before proceeding, which serves as a basic validation gate.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 03:05 PM