improve-skill
Warn
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to create Git worktrees and manage branches using dynamic identifiers.
- Evidence: The skill uses
git -C ~/Developer/fabrik worktree add ../fabrik-improve-skill-<slug> -b improve-skill/<slug>where<slug>is a description derived from the conversation. - Risk: If the agent does not properly sanitize the generated
<slug>string, a malicious conversation could potentially trigger command injection during the worktree creation process. - [EXTERNAL_DOWNLOADS]: The skill clones the vendor's primary repository if a local copy is not available.
- Evidence: The instructions specify to "clone maragudk/fabrik to a temp directory" in Step 4.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it processes untrusted data to perform high-privilege actions.
- Ingestion points: The skill reads the entire current conversation history to "Gather signals" in Step 1.
- Boundary markers: There are no specified delimiters or instructions to ignore potential commands embedded in the conversation data.
- Capability inventory: The skill possesses the ability to execute shell commands (
git), write to files (skills/*/SKILL.md), and perform network operations (pushing branches and opening PRs/issues). - Sanitization: The instructions do not define sanitization or validation logic for the content extracted from the conversation before it is used to generate code changes or CLI arguments.
Audit Metadata