publish-the-skill
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands locally, including
git,gh(GitHub CLI), andzipto package the skill and manage the repository. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it extracts values like
nameanddescriptionfrom a localSKILL.mdfile and interpolates them directly into shell commands and GitHub Action workflows. If these fields contain shell metacharacters or malicious scripts, they could be executed during the packaging or release process. - Ingestion points: SKILL.md (frontmatter fields: name, description).
- Boundary markers: None present; values are directly assigned to variables and used in heredocs/templates.
- Capability inventory: Subprocess calls for
zip,git, andghin SKILL.md. - Sanitization: No sanitization or validation of extracted metadata is performed before interpolation into commands.
Audit Metadata