game-audio
Warn
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The 'Companion check' section in SKILL.md includes instructions that command the agent to perform specific background actions immediately upon activation. This overrides the agent's default behavior by forcing it to execute shell commands and check for the presence of other skills.- [COMMAND_EXECUTION]: The skill directs the agent to run the 'ls' command on multiple directory paths within the user's home folder (including ~/.claude/skills/ and ~/.agent/skills/). This constitutes environment reconnaissance to map installed software without explicit user initiation.- [EXTERNAL_DOWNLOADS]: The instructions encourage the user to install additional remote content from the vendor's repository using the 'npx' utility, which facilitates the download and execution of external code.
Audit Metadata