author-skill
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for running local project scripts such as
npm run manifest,npm run validate,npm test, andbash scripts/eval-lint.sh. These commands are used to manage the repository's skill catalog and ensure new skills meet formatting and structural requirements. - [REMOTE_CODE_EXECUTION]: The instructions reference the use of
npx @ericrisco/rscto add or install new skills. This command downloads and executes a package from the NPM registry. The package belongs to the vendor's official namespace and is a core component of the development workflow. - [INDIRECT_PROMPT_INJECTION]: The skill serves as a meta-authoring tool that converts user-provided natural language into structured
SKILL.mdandcases.yamlfiles. It mitigates potential injection risks by enforcing structural constraints, such as YAML validity checks and strict character length limits for metadata fields. - [DYNAMIC_EXECUTION]: The documentation includes a helper script that uses a Python one-liner (executed via a bash heredoc) to verify that the
SKILL.mdfrontmatter is valid YAML and adheres to specific length and metadata requirements.
Audit Metadata