create-skill
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input to generate new skill definitions, which are then integrated into the agent's environment.
- Ingestion points: The
<skill-name>argument and functional requirements provided by the user in Step 2 ofSKILL.md. - Boundary markers: The prompt templates for the subagents do not use delimiters or explicit instructions to ignore potentially malicious instructions within the user-provided data.
- Capability inventory: The skill writes new files (
SKILL.md) and executes shell commands (ln -s) to register the new skill in the.claude/skills/directory. - Sanitization: No sanitization or validation is performed on user input before it is used to name files or generate executable instruction content.
- [COMMAND_EXECUTION]: The skill uses shell commands (
ln -s,ls) to manage local symbolic links for skill registration, a capability that relies on the integrity of the user-provided skill name strings.
Audit Metadata