run-history-skill-builder

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary run history, logs, and artifacts (documented in SKILL.md and references/history-mining.md). This creates an inherent surface for instructions embedded in the processed data to influence the agent during the skill creation process.
  • Ingestion points: Untrusted data enters the agent context through conversation history, user-provided logs, and artifacts specified in SKILL.md (Workflow Step 2) and references/history-mining.md (Source Priority).
  • Boundary markers: The skill relies on manual intent and scope locking, but it lacks explicit prompt delimiters or structural markers to isolate processed data from the agent's internal reasoning.
  • Capability inventory: The agent is instructed to write files (Workflow Step 9) and execute a bundled Python validation script (scripts/validate_skill_package.py).
  • Sanitization: The skill incorporates a privacy scanner within scripts/validate_skill_package.py to detect and warn about leaked machine-specific absolute paths (e.g., /Users/, /home/) and potential credentials.
  • [DYNAMIC_EXECUTION]: The skill generates new scripts based on the reconstructed workflow and performs runtime verification of Python code using the py_compile module as part of its validation process, as seen in the Validation section of SKILL.md and the implementation in scripts/validate_skill_package.py.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 03:47 AM
Security Audit — agent-trust-hub — run-history-skill-builder