lint
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
skilllintutility via theuvxcommand in a Bash environment to perform quality checks on skill directories. - [EXTERNAL_DOWNLOADS]: The skill triggers the download and execution of the
skilllintpackage from a remote registry at runtime using theuvxtool. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user arguments and external tool outputs, which constitutes an indirect prompt injection surface.
- Ingestion points: User-provided
<path>argument and the output generated by theuvx skilllintcommand. - Boundary markers: Not explicitly defined for the external tool output.
- Capability inventory: Execution of shell commands through Bash and
uvx. - Sanitization: The skill contains proactive security instructions that explicitly warn the agent not to splice user-supplied text into shell-interpreted strings or dynamic context injection patterns (e.g.,
!...) to prevent command injection.
Audit Metadata