iskronify
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to perform repository audits and version checks.
- Evidence: It reads plugin cache files (
cat ~/.claude/plugins/cache/...), uses the GitHub CLI (gh release view), and queries the version of the local bridge utility (node ~/.iskron-bridge/iskron-bridge.mjs --version). - [PERSISTENCE]: The skill modifies local configuration files to install lifecycle hooks and plugins that run across different sessions.
- Evidence: It updates
.claude/settings.jsonwithSessionStart,PostToolUse, andPreToolUsehooks. It also deploys JavaScript-based plugins into the.opencode/plugins/directory to manage session rituals. - [DYNAMIC_EXECUTION]: The skill uses dynamic code loading to initialize specialized sub-agents.
- Evidence: Sub-agents are configured to load a vendor-provided bridge script from the user's home directory (
~/.iskron-bridge/iskron-bridge.mjs) using thenode -ecommand. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data to generate and update agent instructions in files like
AGENTS.md. - Ingestion points: Reads metadata and configuration from
package.json,README.md,Makefile, and various CI/workflow YAML files. - Boundary markers: Uses distinct YAML frontmatter blocks and specific 'source' fields (e.g.,
'Граф — источник': 'выведено') to distinguish extracted facts from manual directives. - Capability inventory: The skill has extensive file-writing permissions, subprocess execution capabilities, and the ability to spawn sub-agents with varying model tiers.
- Sanitization: It includes a mandatory 'Verification' step (Step 7) where it cross-references generated output against the source files to ensure accuracy and prevent instructions from diverging from repository facts.
Audit Metadata