library-skills

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill utilizes npx library-skills and uvx library-skills to execute its management logic. These commands download and run the tool directly from the NPM and PyPI registries.
  • [COMMAND_EXECUTION]: The instructions direct the agent to run standard shell commands for project environment setup and maintenance, such as npm install, bun install, and uv sync.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download of tools and skill definitions from external package registries during its discovery and installation processes.
  • [PROMPT_INJECTION]: The skill facilitates a surface for indirect prompt injection by scanning project dependencies for skills to install. Ingestion points: Scans .agents/skills directories within installed packages. Boundary markers: None identified for individual discovered skills. Capability inventory: Can install or symlink skills into the project's active skill directory. Sanitization: Relies on the user or agent to review discovered skills before installation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 01:23 PM
Security Audit — agent-trust-hub — library-skills