skill-registry
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill performs broad scans of sensitive global directories in the user's home path, including
~/.claude/skills/,~/.cursor/skills/,~/.gemini/skills/, and~/.config/opencode/skills/. It extracts content from these files and persists it into the local project's.atl/skill-registry.mdand an external memory store via themem_savetool. This behavior can lead to the exposure of private or sensitive global configurations to a shared project environment or external services. - [INDIRECT_PROMPT_INJECTION]: The skill serves as a data aggregator for sub-agent instructions, reading untrusted input from external files including
SKILL.md,CLAUDE.md, and.cursorrulesto generate compact rules for downstream agents. - Ingestion points: Reads files from project root and various global directories in Step 1 and 2.
- Boundary markers: The skill does not implement delimiters or warnings to ignore embedded instructions within the summarized content.
- Capability inventory: File system reading, local file writing, and usage of the
mem_savetool for external persistence. - Sanitization: There is no evidence of escaping, validation, or filtering of the content extracted from the external source files before it is processed into the registry.
Audit Metadata