marketplace-manager

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the marketplace, including 'git' for version control, 'gh' for repository management, and filesystem commands like 'mkdir', 'cp', and 'rm'.
  • [DATA_EXFILTRATION]: The skill reads from private user directories such as '/.claude/skills/' and '/.codex/skills/' to import content into the marketplace repository. It also performs 'git push' operations to send local content to a remote repository.
  • [PROMPT_INJECTION]: The 'import' flow presents an indirect prompt injection surface by ingesting 'SKILL.md' files from arbitrary local paths. These files are external content processed by the agent.
  • Ingestion points: Reads 'SKILL.md' files and their YAML frontmatter from user-provided local directories (e.g., ~/.claude/skills/).
  • Boundary markers: No explicit instructions to treat imported content as untrusted data or wrap it in markers are provided in the manifest.
  • Capability inventory: Includes file system writes, directory deletion ('rm -rf'), and remote network operations via 'git push'.
  • Sanitization: The skill performs 'kebab-case' validation on names but does not verify the content of the imported files before storage and publication.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 06:48 AM
Security Audit — agent-trust-hub — marketplace-manager