create-verification-skill
Warn
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructions require the agent to generate a new project-specific skill and immediately execute it. Step 4 ('Prove the generated skill before handing it over') mandates running the generated 'launch', 'doctor', and 'drive' commands. This 'generate-then-execute' pattern lacks a human-in-the-loop review before initial execution.
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it 'interviews' the repo's codebase to determine its execution logic.
- Ingestion points: The agent reads repo-level documentation, package scripts, and Makefiles to determine how to drive the application (SKILL.md, Section 1).
- Boundary markers: There are no instructions to treat repository content as untrusted or to ignore instructions embedded within the codebase files.
- Capability inventory: The agent is empowered to execute shell commands for application startup, terminal interaction (via tmux/PTY), and cleanup.
- Sanitization: The skill does not define validation or sanitization rules for the commands it derives from the repository's 'dev commands' or 'existing harnesses'.
Audit Metadata