claude-code-skills
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to retrieve a
README.mdfile from the author's GitHub repository (gmh5225/awesome-skills) using WebFetch to access a full resource list. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external URL, creating a potential surface for indirect instructions to influence agent behavior.
- Ingestion points: The
README.mdfile located athttps://raw.githubusercontent.com/gmh5225/awesome-skills/refs/heads/main/README.mdis intended to be fetched and processed by the agent. - Boundary markers: None present in the provided instructions to delimit the external content or warn the agent to ignore embedded instructions.
- Capability inventory: The skill uses network read capabilities (WebFetch) to access the remote content.
- Sanitization: No sanitization, escaping, or validation steps are defined for the content retrieved from the external source.
Audit Metadata