lint

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the skilllint utility via the uvx command in a Bash environment to perform quality checks on skill directories.
  • [EXTERNAL_DOWNLOADS]: The skill triggers the download and execution of the skilllint package from a remote registry at runtime using the uvx tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user arguments and external tool outputs, which constitutes an indirect prompt injection surface.
  • Ingestion points: User-provided <path> argument and the output generated by the uvx skilllint command.
  • Boundary markers: Not explicitly defined for the external tool output.
  • Capability inventory: Execution of shell commands through Bash and uvx.
  • Sanitization: The skill contains proactive security instructions that explicitly warn the agent not to splice user-supplied text into shell-interpreted strings or dynamic context injection patterns (e.g., !...) to prevent command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 10:27 AM