run-history-skill-builder
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary run history, logs, and artifacts (documented in
SKILL.mdandreferences/history-mining.md). This creates an inherent surface for instructions embedded in the processed data to influence the agent during the skill creation process. - Ingestion points: Untrusted data enters the agent context through conversation history, user-provided logs, and artifacts specified in
SKILL.md(Workflow Step 2) andreferences/history-mining.md(Source Priority). - Boundary markers: The skill relies on manual intent and scope locking, but it lacks explicit prompt delimiters or structural markers to isolate processed data from the agent's internal reasoning.
- Capability inventory: The agent is instructed to write files (Workflow Step 9) and execute a bundled Python validation script (
scripts/validate_skill_package.py). - Sanitization: The skill incorporates a privacy scanner within
scripts/validate_skill_package.pyto detect and warn about leaked machine-specific absolute paths (e.g.,/Users/,/home/) and potential credentials. - [DYNAMIC_EXECUTION]: The skill generates new scripts based on the reconstructed workflow and performs runtime verification of Python code using the
py_compilemodule as part of its validation process, as seen in theValidationsection ofSKILL.mdand the implementation inscripts/validate_skill_package.py.
Audit Metadata