003-skills-inventory
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a utility for generating documentation. No malicious patterns were identified during the analysis of the instructions or the reference template.
- [DATA_EXPOSURE]: The skill interacts with local project files, specifically reading
skills-generator/src/main/resources/skills.xmland writingINVENTORY-SKILLS-JAVA.md. There is no evidence of attempts to access sensitive system files (e.g., SSH keys, credentials) or environment variables. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from an external source (
skills.xml). While this constitutes an attack surface for indirect prompt injection if the source file is compromised, the skill's capabilities are limited to markdown file creation and do not include high-risk tools like shell execution, network requests, or privilege escalation, effectively mitigating potential impact. - [COMMAND_EXECUTION]: The skill does not contain any shell commands, subprocess calls, or scripts that execute logic. It focuses entirely on text transformation and file writing within the project scope.
Audit Metadata