bggg-skill-taotie
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
BashandAgenttools to run test tasks and compare the performance of different skills. It includes instructions to execute representative tasks for analysis, which is central to its stated purpose of performance benchmarking. - [EXTERNAL_DOWNLOADS]: The documentation provides standard
git cloneinstructions for installation from the author's GitHub repository (github.com/binggandata/bggg-skill-taotie). These are routine installation procedures for the vendor's own skill. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze other skills (untrusted data). It implements significant security controls including: check for suspicious instructions in external skills, mandatory user confirmation before executing scripts, and creating backups before modification. These mitigations address the inherent risk of processing third-party skill definitions.
- [SAFE]: The skill follows the AgentSkills standard and uses built-in Claude Code tools (Read, Write, Edit, Bash, Agent). It does not include obfuscated code, hidden network exfiltration, or persistence mechanisms.
Audit Metadata