skill-creator-flagos
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's 'Improve' and 'Validate' modes require the agent to read and process the contents of other SKILL.md files and their supporting scripts. This creates an attack surface where a malicious skill being analyzed could attempt to override the agent's behavior.
- Ingestion points: The agent reads SKILL.md, scripts/, and references/ of any skill targeted for improvement or validation.
- Boundary markers: The instructions do not specify any delimiters or 'ignore' markers to separate untrusted file content from the agent's primary instructions.
- Capability inventory: The skill possesses powerful capabilities including Bash execution, file modification (Write/Edit), and permission management (chmod).
- Sanitization: There is no evidence of sanitization or filtering of the content ingested from the target skill files.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute local Python scripts (such as init_skill.py, validate_skills.py, and run_eval.py) and to set file permissions using chmod. These commands are generally well-scoped to the repository's internal tools.
- [DYNAMIC_EXECUTION]: The skill generates new SKILL.md templates and directory structures through the init_skill.py script. While the templates are statically defined within the script, the workflow involves creating and eventually executing new sets of instructions and code files.
Audit Metadata