craftbot-skill-improve

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes 'Action traces' from completed tasks to determine how to apply surgical edits to skill files. This creates a vulnerability where adversarial content within the traces could influence the agent to inject malicious instructions into the permanent skill library.
  • Ingestion points: The skill uses read_file to ingest absolute paths to SKILL_SOURCE_<id>.md files, which contain records of past agent reasoning and tool outputs.
  • Boundary markers: There are no boundary markers or instructions to treat the action trace content as untrusted data or to ignore potential instructions embedded within the logs.
  • Capability inventory: The skill uses stream_edit to modify SKILL.md files, providing a mechanism for persistent modification of agent instructions based on untrusted log data.
  • Sanitization: The skill does not include any validation or sanitization of the evidence gathered from the action trace before it is used to formulate edits.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 01:51 PM
Security Audit — agent-trust-hub — craftbot-skill-improve