add-community-extension
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external, untrusted data from GitHub issue submissions (e.g., extension names, descriptions, and metadata). This content is then interpolated into prompts and repository files, which could be used to influence agent behavior or inject malicious content into the catalog.
- Ingestion points: GitHub issue URL, number, and body content (SKILL.md, Step 1).
- Boundary markers: No specific delimiters or warnings are instructed to separate untrusted issue content from the agent's instructions.
- Capability inventory: The skill can write to the filesystem (
extensions/catalog.community.json,docs/community/extensions.md), execute shell commands (git,python3), and open pull requests. - Sanitization: The skill provides a restrictive regex (
^[a-z][a-z0-9-]*$) for Extension IDs and requires semver for versions. however, other fields like 'Name' and 'Description' lack explicit sanitization before being used in commit messages or documentation tables. - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage repository state and validate file integrity.
- Evidence: Instructions include the use of
git checkout,git commit, andgit pushwith interpolated metadata, as well aspython3 -cfor JSON validation (SKILL.md, Steps 4 and 6). While these are standard administrative tasks, they operate on data derived from external issue submissions.
Audit Metadata