create-skill-from-repo
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell-based git commands (
git submodule add,git clone,git submodule update) using user-provided inputs for<repo-url>and<submodule>. This creates a potential command injection surface if the inputs are not strictly validated. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external repositories and distills it into local documentation. Malicious instructions hidden in the source repository could potentially influence the agent's behavior during the extraction or subsequent usage of the generated skill.
- Ingestion points: Reads documentation files (README.md, docs/, wiki/) and code snippets from the cloned source repository.
- Boundary markers: The instructions do not specify any delimiters or safety prompts to prevent the agent from following instructions embedded within the source material.
- Capability inventory: The skill possesses the ability to create/modify files in the workspace (skills/ directory), update central registry files (AGENTS.md), and perform network operations via git.
- Sanitization: No explicit sanitization, filtering, or validation process is defined for the content extracted from the source repositories.
Audit Metadata