skills-eval-triage
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from evaluation reports (HTML and JSON formats) generated by the
skillevaluatortool. These reports contain findings, descriptions, and suggested fixes derived from other skills in the repository. If a malicious skill is included in the evaluation run, it could potentially poison its own report content to inject instructions that trick the triage agent into performing unauthorized file modifications or command executions beyond the intended fix scope. - Ingestion points: The skill reads
tools/ci/gitlab/skills/report/index.html,SKILL_HEALTH.json, and per-skill T1/T3 HTML reports. - Boundary markers: The instructions do not define clear delimiters or warnings to treat the report content as untrusted data.
- Capability inventory: The skill has capabilities for file reading and writing (SKILL.md and scripts), executing shell commands (git, python3), and installing Python packages.
- Sanitization: There is no explicit sanitization or validation of the suggested fixes contained within the report data before the agent is encouraged to apply them.
Audit Metadata