validate-skills
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill is a documentation and interface definition for a code validation tool. It does not contain executable malicious code, hardcoded credentials, or unauthorized network operations. Its purpose is to improve the security and reliability of other scripts.
- [PROMPT_INJECTION]: The skill processes content from external markdown files (e.g., under
plugins/*/commands/*.md), which represents an indirect prompt injection surface. - Ingestion points: Markdown files passed as arguments or located in plugin directories.
- Boundary markers: Not specified in the instructions.
- Capability inventory: Shell syntax validation (
bash -n,shellcheck) and potential runtime execution of 'GREEN-tier' commands. - Sanitization: Not explicitly mentioned, though the tool itself is designed to flag unsafe patterns.
- [COMMAND_EXECUTION]: The skill description indicates that the validation tool may execute 'GREEN-tier' read-only commands at runtime to detect failures like broken
jqfilters or invalidgreppatterns. This is a functional requirement of the validator and is performed within a development context.
Audit Metadata