verification
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository source code and host evidence to generate and execute "verification recipes." This creates a surface where malicious instructions embedded in a repository could influence generated verification steps.
- Ingestion points: Host and repository evidence, source changes, and owning source entry points (specified in SKILL.md and references/recipe.md).
- Boundary markers: Absent; the instructions do not specify delimiters or warnings for the agent to ignore instructions embedded in the analyzed code.
- Capability inventory: The skill is capable of running mapped user workflows, executing recipes, and performing delegated replay of actions on the host system (SKILL.md).
- Sanitization: Absent; there are no instructions regarding the validation or filtering of content extracted from the repository before it is used to generate executable recipes.
- [COMMAND_EXECUTION]: The skill is designed to discover and run host-specific commands for application verification. While it includes guidelines to respect ownership and avoid unowned services, the execution of arbitrary discovered commands is a core, high-privilege capability.
- [DYNAMIC_EXECUTION]: The skill instructions specify the generation of "consumer-local verify- skills" and helper scripts at runtime. Generating and then executing new logic based on repository metadata is a form of dynamic code generation.
Audit Metadata