marketplace-manager
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the marketplace, including 'git' for version control, 'gh' for repository management, and filesystem commands like 'mkdir', 'cp', and 'rm'.
- [DATA_EXFILTRATION]: The skill reads from private user directories such as '
/.claude/skills/' and '/.codex/skills/' to import content into the marketplace repository. It also performs 'git push' operations to send local content to a remote repository. - [PROMPT_INJECTION]: The 'import' flow presents an indirect prompt injection surface by ingesting 'SKILL.md' files from arbitrary local paths. These files are external content processed by the agent.
- Ingestion points: Reads 'SKILL.md' files and their YAML frontmatter from user-provided local directories (e.g., ~/.claude/skills/).
- Boundary markers: No explicit instructions to treat imported content as untrusted data or wrap it in markers are provided in the manifest.
- Capability inventory: Includes file system writes, directory deletion ('rm -rf'), and remote network operations via 'git push'.
- Sanitization: The skill performs 'kebab-case' validation on names but does not verify the content of the imported files before storage and publication.
Audit Metadata