optimising-skills

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The scripts/coverage-audit.mjs utility uses dynamic import() to load scenario definitions from the local evals directory. This is a standard implementation for test runners and auditing tools to process local files.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions and the scripts/read-answers.mjs utility process transcripts from external agent runs. This presents an indirect prompt injection surface. However, the skill explicitly mitigates this by providing logic to separate different communication channels (speech, thought, and read data), ensuring that data read by the agent is not conflated with instructions during the optimization analysis.
  • [COMMAND_EXECUTION]: The skill provides Node.js scripts that perform file system operations such as reading transcript logs and managing temporary directories for self-testing. These operations are limited to standard diagnostic and testing activities appropriate for a developer-oriented optimization tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 01:25 PM
Security Audit — agent-trust-hub — optimising-skills