competency-builder

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scaffolding script (scripts/scaffold.ts) imports a standard argument parsing utility from the official Deno standard library repository.
  • [COMMAND_EXECUTION]: The skill includes a Deno-based script (scripts/scaffold.ts) designed to generate framework files. The script requires file-system read and write permissions to perform its intended scaffolding function.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data regarding training topics and failure modes to generate framework documentation. While this creates a potential attack surface where malicious input could influence downstream agents reading the documents, the current implementation is focused on methodology and human-readable output.
  • Ingestion points: User input defining the topic, audiences, and cluster names for the framework.
  • Boundary markers: Output is confined to Markdown templates and blocks defined in the skill instructions.
  • Capability inventory: The skill is capable of writing files to the local file system (e.g., framework documentation and output configuration).
  • Sanitization: User-provided strings are interpolated directly into Markdown templates without specialized sanitization, though they are presented within structured documentation formats.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 09:40 AM
Security Audit — agent-trust-hub — competency-builder