evaluate-and-tighten-skills
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes instructions for running bundled scripts (e.g.,
gen_run_stamp.py,rebuild_cache.py,github_project_setup.py) and standard tools likegit,gh, anduv. These executions are scoped to the agent's local environment for the purpose of skill optimization and development tasks. - [REMOTE_CODE_EXECUTION]: The skill documentation and benchmarks mention remote operations (e.g.,
ghCLI commands,curlin examples), but these are demonstrated within a controlled development context for maintenance purposes. No arbitrary or hidden remote code execution was identified. - [DATA_EXFIILLTRATION]: While the skill reads other skill directories and metadata, it does not contain logic to exfiltrate this data. The network operations mentioned in the benchmarks and maintenance templates are legitimate tool usages (e.g., GitHub API via
gh) typical for the skill's stated purpose. - [PROMPT_INJECTION]: The skill contains meta-instructions for modifying other prompts, but these are for optimization purposes. It does not attempt to override the base model's safety guardrails or provide jailbreak-style instructions.
Audit Metadata