create-verification-skill
Warn
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to discover and execute startup commands found within the target repository (e.g., package scripts, Makefiles, README quickstart) to "interview" the application. This involves running arbitrary code provided by the repository being analyzed.
- [COMMAND_EXECUTION]: The "Prove the generated skill" step (Step 4) requires the agent to execute the newly generated verification skill end-to-end. This execution chain includes launching the application and running automated browser/CLI actions which were generated based on untrusted repository content.
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from the repository's codebase and documentation to generate the logic for a new verification skill. Maliciously crafted documentation in the target repo could influence the generated skill to perform unintended actions.
- Ingestion points: Local repository files (README, package.json, source code, routes).
- Boundary markers: None provided in the instructions for the generation phase.
- Capability inventory: File writing (creating the new skill), subprocess execution (launching apps and running the harness).
- Sanitization: No explicit sanitization of repository content is performed before generating the new skill instructions.
Audit Metadata