optimize-claude-md
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes
uvx skilllint@latestto perform file checks, measure token counts, and audit skill completeness. - [COMMAND_EXECUTION]: Employs dynamic context injection (
!pwd) inSKILL.mdto resolve the current working directory during skill initialization. - [EXTERNAL_DOWNLOADS]: Fetches the
skilllintpackage from a standard registry usinguvxto ensure the latest version is used for analysis. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface (Category 8) because it reads and processes user-provided files that are then analyzed by an LLM agent. (1) Ingestion points: Target files and directories provided via
$ARGUMENTSare processed in Phase 3. (2) Boundary markers: The delegation template uses structural separators but lacks specific instructions to ignore embedded commands within the target files. (3) Capability inventory: Performs command execution viauvxinSKILL.md. (4) Sanitization: Includes an independent verification step by a second agent (Phase 5) and requires explicit human approval (Phase 8) before any modifications are written to disk.
Audit Metadata