extend-first
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a set of guidelines for the AI agent to follow when a user requests the creation of a new capability. It instructs the agent to inventory local skill descriptions to check for overlap.
- [DATA_EXPOSURE]: The skill mentions reading local skill directories to inventory names and descriptions. This is a low-risk operation limited to metadata of other skills within the agent's specific development environment, intended for the purpose of preventing duplicates.
- [REMOTE_CODE_EXECUTION]: The README contains an
npxinstallation command (npx skills add m1nga/skills@extend-first). This is a standard installation pattern for this platform and targets the author's own repository (m1nga), representing normal distribution rather than a malicious execution vector. - [PROMPT_INJECTION]: The skill includes instructions to the agent to override or bypass its own check if the user says "build it anyway". This is a legitimate feature for user control and autonomy, not an adversarial injection intended to compromise the agent's safety filters.
Audit Metadata