agent-skill-stack
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several internal Python scripts to perform its core functions, such as building a skill index (
skill_index.py), generating recommendation cards (render_stack_card.py), and managing staged installations (stage_install.py). These scripts are executed locally and are integral to the skill's management capabilities. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and index metadata and instructions from third-party AI Agent Skills, which represents a potential ingestion surface for untrusted data.
- Ingestion points: Metadata and script content are read from various local and remote directories (e.g.,
~/.codex/skills, GitHub repositories) to build the local index and perform risk assessments. - Boundary markers: The skill employs structured parsing for YAML frontmatter in
SKILL.mdfiles and utilizes JSON for its internal records and project profiles to maintain data integrity. - Capability inventory: The skill possesses the ability to read files, calculate cryptographic hashes (SHA-256), write configuration files, and move directories within the filesystem during installation.
- Sanitization: The system implements strict validation, including regular expression checks for skill names and intents, and uses standard HTML escaping when rendering SVG output to prevent injection in visual artifacts. The installation process is staged and explicitly avoids overwriting existing files to prevent unauthorized modifications.
Audit Metadata