bible-study-tool-creator
Warn
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Step 8 of the skill instructions directs the agent to execute a shell command using a hardcoded absolute filesystem path:
python3 /Users/chrispriebe/projects/context-grounded-bible/.claude/skills/bible-study-tool-creator/init-tool.py /tmp/tool-definition.yaml. This reveals the author's local username and project structure, and it creates a static dependency on a path that likely does not exist on the end user's machine. - [DYNAMIC_EXECUTION]: The skill dynamically constructs a YAML configuration file (
/tmp/tool-definition.yaml) by concatenating user-provided strings. This configuration is then used by a local script to generate file structures and AI prompt templates, establishing a pattern where executable logic and instructions are generated from unvalidated runtime input. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through its data-driven file generation process:
- Ingestion points: The skill ingests user-provided text for tool names, descriptions, practical goals, usage examples, and YAML data structures via the
AskUserQuestiontool. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded instructions when the user-supplied content is interpolated into the generated YAML and markdown files.
- Capability inventory: The skill possesses capabilities to write to the filesystem, update a tool registry, and execute shell scripts, which could be leveraged if malicious instructions are embedded in the user input.
- Sanitization: No sanitization, validation, or escaping of user strings is performed before they are written to the temporary YAML file or the final tool templates.
Audit Metadata