create-verification-skill
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill implements a generator pattern that creates new agent instructions and executable scripts (
.agents/skills/verify-<app>/SKILL.md) by extracting operational logic from untrusted repository contents. \n- [DYNAMIC_EXECUTION]: Step 4 of the instructions ("Prove the generated skill") requires the agent to automatically execute the synthesized "Launch", "Doctor", and "Drive" commands. This establishes a direct execution path for shell commands derived from untrusted repository metadata (e.g., package scripts, Makefiles, or READMEs) without manual review or sandboxing. \n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core functionality involves "interviewing" repository documentation and configuration to define the generated skill's behavior. \n - Ingestion points: Files within the target repository (README, package scripts, Makefile) as specified in SKILL.md. \n
- Boundary markers: Absent; the skill does not provide delimiters or instructions for the agent to isolate or ignore potentially malicious strings within the repository content. \n
- Capability inventory: Automated shell execution of repository-sourced commands during the "Prove" phase. \n
- Sanitization: Absent; the skill instructs the agent to adopt the repo's existing commands exactly as documented. \n- [PERSISTENCE]: The skill directs the agent to link the generated skill directory into global or local discovery paths (e.g., directories maintained by
npx skills), ensuring that the synthesized (and potentially untrusted) code persists and remains discoverable by the agent in future sessions. \n- [COMMAND_EXECUTION]: The skill utilizes shell commands to link directories and execute the generated verification routines, enabling the primary risk of automated arbitrary command execution.
Audit Metadata