skill
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The /skill setup and /skill scan commands utilize shell scripts involving find, grep, and stat to locate and parse skill metadata. Additionally, the /skill remove command performs recursive directory deletion. While intended for skill management, these operations allow for file system discovery and content parsing.
- [EXTERNAL_DOWNLOADS]: The /skill import functionality allows the agent to fetch skill definitions from arbitrary, user-provided URLs. This could be leveraged to introduce unverified instructions into the agent's environment if the source is not trusted.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) through its conversation scanning and URL import features. Ingestion points: External URLs and current conversation context via /skill setup. Boundary markers: Skill templates use YAML frontmatter delimiters (---). Capability inventory: Shell execution and file writing capabilities are active. Sanitization: The instructions recommend format validation but do not specify robust sanitization or filtering logic.
Audit Metadata