get-available-resources
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/detect_resources.pyinvokes system utilities such asnvidia-smi,rocm-smi,sysctl, andsystem_profilerto identify hardware specifications. These calls are made using safe subprocess configurations with argument lists rather than shell strings. - [DYNAMIC_EXECUTION]: The detection script uses
__import__('datetime')to dynamically load the standard library datetime module for timestamping the output file. This is a benign use of dynamic importing for basic functionality. - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface by having the agent ingest system data from a generated JSON file to influence its subsequent actions.
- Ingestion points: The AI agent is instructed to read
.claude_resources.json(created inSKILL.mdandscripts/detect_resources.py) to determine parallelization and memory strategies. - Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the data read from the JSON file.
- Capability inventory: The skill primarily performs hardware reconnaissance and file writing to the local workspace; it does not perform network operations or high-privilege file access.
- Sanitization: Hardware metrics are converted to floating-point numbers or strings and serialized into a structured JSON format, providing a layer of data consistency.
Audit Metadata