skill-inventory-auditor

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to perform maintenance tasks.
  • Evidence: Uses rm -rf {directory_path} to delete duplicate skill installations in Phase 3.
  • Evidence: Performs git operations including git fetch, git pull, and git stash for repository synchronization.
  • Evidence: Executes a local script python3 {SKILL_DIR}/scripts/scan_inventory.py to identify duplicates.
  • [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection via the processing of untrusted skill metadata.
  • Ingestion points: scripts/scan_inventory.py reads and parses SKILL.md files from multiple potential installation paths on the system (~/.claude/skills/, ~/.agents/skills/, and .claude/skills/).
  • Boundary markers: Employs YAML frontmatter parsing to extract metadata fields like 'description'.
  • Capability inventory: Includes the ability to delete file system directories and execute shell commands.
  • Sanitization: No explicit sanitization is performed on ingested description strings before they are presented to the agent; however, the instruction set mandates user confirmation before execution of deletions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 04:19 AM
Security Audit — agent-trust-hub — skill-inventory-auditor