skill-developer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents an auto-activation system that ingests untrusted data, such as user prompts and file contents, to trigger context injection or tool blocking.\n
- Ingestion points: The system ingests user prompts via the UserPromptSubmit hook and file metadata/content via the PreToolUse hook, as detailed in HOOK_MECHANISMS.md.\n
- Boundary markers: The guide illustrates the use of visual delimiters for injected suggestions but does not mandate or describe sanitization of the untrusted input before regex processing.\n
- Capability inventory: The described hooks possess the capability to inject arbitrary text into the agent's context and prevent the execution of file-editing tools.\n
- Sanitization: The documentation lacks instructions for escaping or validating content extracted from user prompts or project files.\n- [COMMAND_EXECUTION]: The skill includes shell and npx command examples for verifying the functionality of local hook scripts within the .claude/hooks directory.\n
- Evidence: The guide provides commands such as 'npx tsx .claude/hooks/skill-activation-prompt.ts' and shell heredocs to test hook logic against simulated inputs.
Audit Metadata