author-skill

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for running local project scripts such as npm run manifest, npm run validate, npm test, and bash scripts/eval-lint.sh. These commands are used to manage the repository's skill catalog and ensure new skills meet formatting and structural requirements.
  • [REMOTE_CODE_EXECUTION]: The instructions reference the use of npx @ericrisco/rsc to add or install new skills. This command downloads and executes a package from the NPM registry. The package belongs to the vendor's official namespace and is a core component of the development workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill serves as a meta-authoring tool that converts user-provided natural language into structured SKILL.md and cases.yaml files. It mitigates potential injection risks by enforcing structural constraints, such as YAML validity checks and strict character length limits for metadata fields.
  • [DYNAMIC_EXECUTION]: The documentation includes a helper script that uses a Python one-liner (executed via a bash heredoc) to verify that the SKILL.md frontmatter is valid YAML and adheres to specific length and metadata requirements.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 10:54 PM