repo-explorer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection pattern (
!) inSKILL.mdto executemkdirandlscommands when the skill is loaded. This is used to maintain and display the state of the local repository cache (~/.explore/repos). - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external Git repositories, creating a risk of indirect prompt injection.
- Ingestion points: External repository content is brought into the agent's environment via
git clone <repo-url>into~/.explore/repos/. - Boundary markers: Absent. The skill does not instruct the agent to treat the downloaded files as untrusted or provide delimiters for context separation.
- Capability inventory: The skill utilizes shell tools for directory management (
mkdir,ls), cloning (git), and file exploration (rg, file reads). - Sanitization: Absent. The agent is explicitly told to inspect local instructions and project metadata within the cloned repositories without prior sanitization.
- [EXTERNAL_DOWNLOADS]: The skill enables the cloning of entire repositories from external URLs provided at runtime.
Audit Metadata