ip-management
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructional content and guidance on intellectual property management without malicious patterns or suspicious instructions.\n- [COMMAND_EXECUTION]: The skill instructs the agent to run an
lscommand on standard skill directories (e.g.,~/.claude/skills/) to check if recommended companion skills are installed. This is a functional requirement for its 'Companion check' feature and does not target sensitive user files.\n- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it is designed to analyze untrusted external data such as project dependency files and license metadata.\n - Ingestion points: Dependency manifest files (e.g.,
package.json,requirements.txt) and software licensing metadata read from the workspace.\n - Boundary markers: Absent; the skill does not provide explicit delimiters or instructions to ignore embedded commands in the analyzed data.\n
- Capability inventory: Ability to run shell commands for auditing (e.g.,
ls,license-checker) and read local project files.\n - Sanitization: No content validation or escaping of external data is specified in the instructions.
Audit Metadata