zj-merge-skills-wave
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to perform its core functions. Specifically, it uses
git clone --depth 1 <url> <scratch>to fetch remote content when a GitHub URL is provided by the human user. - [EXTERNAL_DOWNLOADS]: The skill is designed to download entire repositories from arbitrary external GitHub URLs provided by the user. The downloaded content is stored in a temporary scratch directory (
C:/tmp/skill-source-<random>/) for metadata extraction. - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection because it ingests and processes data from external, potentially untrusted sources.
- Ingestion points: Metadata such as
nameanddescriptionare extracted fromSKILL.mdfiles found in the resolved source directory (SKILL.md, Step 2). - Boundary markers: The instructions do not specify any delimiters or warnings to ignore embedded instructions when reading the extracted metadata.
- Capability inventory: The skill possesses shell execution capabilities (
git clone), file system traversal, and the ability to trigger other skills (zj-roadmap-driven,zj-merge-skill-pair). - Sanitization: There is no mention of sanitizing or validating the
nameordescriptionfields before they are presented to the user or recorded in the roadmap decision tree.
Audit Metadata