choose-skill
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze user requests and repository configurations to recommend a sequence of other skills to invoke. This architectural pattern creates an indirect prompt injection surface where a crafted user request could attempt to manipulate the agent's choice of tools or execution flow.
- Ingestion points: User requests and repository configurations are ingested in
SKILL.mdto drive the recommendation logic. - Boundary markers: The instructions do not define clear delimiters or include safety warnings to ignore instructions embedded within the user data.
- Capability inventory: The skill directs the agent to recommend starting points and load other skills via the 'Skill tool' or by reading their respective
SKILL.mdfiles. - Sanitization: No input validation or sanitization mechanisms are present to filter potentially malicious content from the user request before processing.
Audit Metadata