optimising-skills
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
scripts/coverage-audit.mjsutility uses dynamicimport()to load scenario definitions from the localevalsdirectory. This is a standard implementation for test runners and auditing tools to process local files. - [INDIRECT_PROMPT_INJECTION]: The skill instructions and the
scripts/read-answers.mjsutility process transcripts from external agent runs. This presents an indirect prompt injection surface. However, the skill explicitly mitigates this by providing logic to separate different communication channels (speech, thought, and read data), ensuring that data read by the agent is not conflated with instructions during the optimization analysis. - [COMMAND_EXECUTION]: The skill provides Node.js scripts that perform file system operations such as reading transcript logs and managing temporary directories for self-testing. These operations are limited to standard diagnostic and testing activities appropriate for a developer-oriented optimization tool.
Audit Metadata