validate-skills

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill is a documentation and interface definition for a code validation tool. It does not contain executable malicious code, hardcoded credentials, or unauthorized network operations. Its purpose is to improve the security and reliability of other scripts.
  • [PROMPT_INJECTION]: The skill processes content from external markdown files (e.g., under plugins/*/commands/*.md), which represents an indirect prompt injection surface.
  • Ingestion points: Markdown files passed as arguments or located in plugin directories.
  • Boundary markers: Not specified in the instructions.
  • Capability inventory: Shell syntax validation (bash -n, shellcheck) and potential runtime execution of 'GREEN-tier' commands.
  • Sanitization: Not explicitly mentioned, though the tool itself is designed to flag unsafe patterns.
  • [COMMAND_EXECUTION]: The skill description indicates that the validation tool may execute 'GREEN-tier' read-only commands at runtime to detect failures like broken jq filters or invalid grep patterns. This is a functional requirement of the validator and is performed within a development context.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 08:26 AM
Security Audit — agent-trust-hub — validate-skills