Skills
Navigate
skills/lovstudio/skills/lov-gen-project-name/Gen Agent Trust Hub

lov-gen-project-name

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes arbitrary text describing project purposes to generate name suggestions, representing a surface for indirect prompt injection.\n
  • Ingestion points: User-provided project descriptions and purpose statements processed in the primary workflow (SKILL.md).\n
  • Boundary markers: Defined in SKILL.md under 'Execution boundary', specifying read-only analysis and explicit scopes for modifications.\n
  • Capability inventory: File system access via scripts/profile_store.py and metadata validation via scripts/validate_skill.py.\n
  • Sanitization: The profile management script (scripts/profile_store.py) prevents the storage of sensitive keys (tokens, passwords, secrets, etc.) using a case-insensitive blacklist and validates identifiers using regex. Slugs are restricted to alphanumeric characters and hyphens.\n- [COMMAND_EXECUTION]: The skill includes Python scripts designed to manage local configuration and validate skill integrity through file system operations.\n
  • Evidence: scripts/profile_store.py performs atomic writes to a shared profile JSON located in the user's config directory (e.g., ~/.config/agent-skills/profile.json).\n
  • Evidence: scripts/validate_skill.py parses YAML frontmatter and validates skill metadata, requiring the PyYAML library for execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 09:47 AM
Security Audit — agent-trust-hub — lov-gen-project-name