update-agent-skills

Warn

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Employs shell commands via the Skills CLI to manage local skill installations and verify their current status.
  • [PERSISTENCE]: The skill can modify the ~/.claude/settings.json file to register a SessionStart hook, ensuring the update logic executes automatically whenever a new session begins.
  • [EXTERNAL_DOWNLOADS]: Retrieves repository metadata and tree structures from the GitHub API to perform freshness checks.
  • [DYNAMIC_EXECUTION]: Utilizes a shell script generated at runtime to facilitate automatic updates when the user has opted into the auto-update mode.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub repositories, which is a potential vector for indirect instructions.
  • Ingestion points: Repository data and release notes fetched from GitHub in scripts/check-pack-freshness.mjs.
  • Boundary markers: A rewakeMessage is included in the hook configuration to clarify the nature of the output to the agent.
  • Capability inventory: Permissions include writing to configuration files and executing shell-based update commands.
  • Sanitization: The skill verifies that skill names match expected patterns before they are included in command executions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 13, 2026, 03:33 PM
Security Audit — agent-trust-hub — update-agent-skills