skills/kevinslin/agstack/sc/Gen Agent Trust Hub

sc

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill's integration test suite (scripts/tests/test_sc_scripts_integration.py) utilizes subprocess.run() to execute local Python scripts during testing. These calls are restricted to internal project files using sys.executable and do not ingest external or unsanitized input.
  • [DYNAMIC_EXECUTION]: The skill implements automated file generation and modification via init_skill.py and rename_skill.py. These scripts include strict validation for skill names (using regex ^[a-z0-9][a-z0-9.-]*$) to prevent injection attacks and ensure generated files adhere to required naming conventions.
  • [INDIRECT_PROMPT_INJECTION]: While the skill ingests user input to generate new skill documentation and scripts, it operates within a fixed directory structure and uses template-based generation. The provided validation tools (quick_validate.py) check for compliance with security best practices, such as ensuring all file references are relative and preventing cross-skill path manipulation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 07:25 AM