skills-sh-maintainer
Fail
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to read a GitHub Personal Access Token (PAT) from a local file path (
../secrets/github/pat.txt), promoting the use of unencrypted plain-text secrets. - [COMMAND_EXECUTION]: The skill executes PowerShell code that retrieves and interpolates a secret token directly into a git command:
git push "https://${pat}@github.com/farukzahra/agent-skills.git" main. This exposes the token in process lists and command history. - [EXTERNAL_DOWNLOADS]: The documentation references
npx skills add farukzahra/agent-skills, which downloads and executes packages from the npm registry at runtime. - [COMMAND_EXECUTION]: The skill triggers the execution of a local PowerShell script
../agent-skills/scripts/sync-faruk-skills.ps1to synchronize skills. - [INDIRECT_PROMPT_INJECTION]: The skill manages the creation and updating of other agent skills, presenting an attack surface for instructions embedded in user-supplied data.
- Ingestion points: User input defining the content of
SKILL.mdfiles. - Boundary markers: No specific delimiters or warnings for embedded instructions are defined.
- Capability inventory: The skill possesses file write access, local script execution (
sync-faruk-skills.ps1), and network capabilities (git push). - Sanitization: No sanitization or validation of generated skill content is mentioned.
Recommendations
- AI detected serious security threats
Audit Metadata