use-goal
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill serves as a template generator for agent goals based on user-provided tasks, creating a surface for indirect prompt injection where untrusted data could influence the final objective.
- Ingestion Points: In SKILL.md, the agent reads user requests, repository documentation, and logs to draft goals.
- Capability Inventory: The skill facilitates creating goals that execute shell commands, run tests, and perform builds (references/claude-code-goal.md, references/codex-goal.md).
- Boundary Markers: There are no explicit instructions to sanitize user input or delimiters to isolate user-provided text within the goal objective.
- Sanitization: No sanitization logic is defined for the input tasks.
- [COMMAND_EXECUTION]: The skill includes a Node.js script template in references/verification-harnesses.md used for local file analysis. While intended for benign use cases like code refactoring, it demonstrates a capability for generating and executing local code.
- [SAFE]: The skill references official documentation from trusted organizations, including Anthropic (code.claude.com) and OpenAI (developers.openai.com).
Audit Metadata