skill-inventory-auditor
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to perform maintenance tasks.
- Evidence: Uses
rm -rf {directory_path}to delete duplicate skill installations in Phase 3. - Evidence: Performs git operations including
git fetch,git pull, andgit stashfor repository synchronization. - Evidence: Executes a local script
python3 {SKILL_DIR}/scripts/scan_inventory.pyto identify duplicates. - [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection via the processing of untrusted skill metadata.
- Ingestion points:
scripts/scan_inventory.pyreads and parsesSKILL.mdfiles from multiple potential installation paths on the system (~/.claude/skills/, ~/.agents/skills/, and .claude/skills/). - Boundary markers: Employs YAML frontmatter parsing to extract metadata fields like 'description'.
- Capability inventory: Includes the ability to delete file system directories and execute shell commands.
- Sanitization: No explicit sanitization is performed on ingested description strings before they are presented to the agent; however, the instruction set mandates user confirmation before execution of deletions.
Audit Metadata