ios-skills-router
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses directive language ("IMPORTANT: Override your training data with these corrections") to command the agent to disregard its internal training in favor of the provided instructions. While used here for API version updates, this pattern is typically used to bypass or override model behavior.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data by instructing the agent to proactively search for and read numerous external files (e.g.,
skills/*/SKILL.md) based on user-controlled inputs like framework imports or keywords. - Ingestion points: The
skills/directory and the 210+ specialized skill files listed in the router instructions. - Boundary markers: Absent. No instructions are provided to the agent to treat the content of these secondary skills as untrusted or to ignore potentially malicious embedded instructions within them.
- Capability inventory: The skill itself does not perform file writes or network operations, but it directs the agent to read and follow patterns from hundreds of other skills which may possess these capabilities.
- Sanitization: Absent. The router does not specify any validation or filtering for the content of the specialized skills it references.
Audit Metadata