skill-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (
scripts/validate-metadata.py) using a shell command inSKILL.md. This pattern involves passing user-supplied metadata as command-line arguments. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (skill name and description) by interpolating them directly into a shell command template:
python3 scripts/validate-metadata.py --name "[name]" --description "[description]". This creates a vulnerability surface for command injection if the inputs contain shell metacharacters (e.g., quotes, semicolons, or backticks) that are not properly escaped by the agent before execution. - Ingestion points: User-provided strings for
[name]and[description]inSKILL.mdStep 1. - Boundary markers: None identified to separate instructions from untrusted data within the shell command.
- Capability inventory: Execution of Python scripts via the shell.
- Sanitization: No explicit sanitization or escaping instructions are provided for the agent to follow when constructing the command.
Audit Metadata