fable-recover
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external failure evidence and error logs which could contain malicious instructions. Evidence collection occurs in SKILL.md (Stage 1) and templates/recovery-diagnosis.template.md. The structured recovery protocol (falsification, reproduction) acts as a verification step, though explicit input delimiters are not used. The skill's primary focus is diagnostic reading of system state rather than execution of untrusted logic.
- [COMMAND_EXECUTION]: Reference documents suggest standard diagnostic commands such as git status, which bun, and node -v to verify the execution environment. It also suggests clearing build caches using rm -rf dist. These operations are consistent with the skill's primary purpose and do not pose a security risk in this context.
- [NO_CODE]: The skill does not include any executable scripts, binary files, or external dependencies, consisting entirely of markdown instructions and YAML metadata.
Audit Metadata