prompt-craft
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is focused on text transformation and prompt generation. It does not contain any malicious code or hidden instructions that would compromise the host system or the user's data.
- [PROMPT_INJECTION]: The instructions use strong directive language to establish a persona ("Once loaded, you ARE prompt-craft"), but this is standard for agent skills. It includes clear 'Explicit exit' conditions and handles meta-requests about the tool itself by exiting the persona mode, which is a good security practice.
- [DATA_EXPOSURE]: The skill references several local markdown files within a
knowledge/directory (e.g.,user-context.md,brand-voice.md). These are used to provide relevant context for prompt generation. There is no evidence of these files being accessed in a way that suggests exfiltration or unauthorized exposure of sensitive system files. - [COMMAND_EXECUTION]: The skill does not utilize any shell commands, subprocesses, or dynamic execution patterns. It relies entirely on text processing and internal logic.
- [EXTERNAL_DOWNLOADS]: No external URLs or remote package dependencies are referenced within the skill. All operation occurs within the local environment.
Audit Metadata