skills/efoo-team/skills/create-skill/Gen Agent Trust Hub

create-skill

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of local shell commands and scripts for skill validation and environment setup.
  • Runs "python3 ~/ghq/github.com/efoo-team/skills/scripts/check-skills.py" to perform linting and similarity checks on created skills.
  • Executes "bash ~/ghq/github.com/efoo-team/skills/setup.sh" to update the local skill distribution.
  • Uses "npx skills@1.5.14 add ..." for managing skill packages.
  • Performs standard filesystem operations such as "mkdir" and "ln -s" for symbolic link management in project-specific directories.
  • [EXTERNAL_DOWNLOADS]: Provides instructions for subscribing to external skill repositories.
  • Directs the use of "npx skills" to fetch content from user-specified GitHub repositories ("/").
  • Includes explicit documentation in "references/registration.md" advising the user to audit external repositories for malicious scripts before installation.
  • [INDIRECT_PROMPT_INJECTION]: The skill serves as a scaffolding tool that generates new agent instructions based on untrusted user input.
  • Ingestion points: User requests and requirements provided during the Phase 1 interview process and Phase 4 authoring phase.
  • Boundary markers: Implements a multi-phase workflow with explicit "Gates" requiring user confirmation before proceeding to code generation.
  • Capability inventory: File system write access (creating SKILL.md and associated files) and subprocess execution for verification.
  • Sanitization: Relies on post-generation verification via the "check-skills.py" script to ensure compliance with YAML standards and organizational policies.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 02:52 PM
Security Audit — agent-trust-hub — create-skill