markdown-to-skill
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the processing of untrusted content.
- Ingestion points: The skill reads all Markdown files from a user-specified directory (Step 3).
- Boundary markers: The workflow does not implement boundary markers or instructions to the agent to disregard embedded directives in the source files.
- Capability inventory: The skill utilizes
lsandGlobfor file discovery and has the capability to write newSKILL.mdfiles to the agent's global and local skills directories (Step 5). - Sanitization: The skill copies the source file content into new skills without sanitizing or validating the text. Consequently, hidden instructions in a source file could be promoted to a persistent, active agent skill.
- [COMMAND_EXECUTION]: The skill performs filesystem operations and file creation in the agent's internal configuration paths (~/.claude/skills/). Although this matches the skill's purpose, it constitutes a modification of the agent's operational environment based on external documentation.
Audit Metadata