provider-health
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local helper scripts
${CLAUDE_PLUGIN_ROOT}/scripts/helpers/check-providers.shand${CLAUDE_PLUGIN_ROOT}/scripts/helpers/check-versions.shto gather data on provider availability and software versions. These operations appear consistent with the stated purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes and summarizes external output from system scripts, creating a potential surface for indirect injection if the local environment generates malicious output.
- Ingestion points: Output from the
check-providers.shandcheck-versions.shscripts referenced inSKILL.md. - Boundary markers: None identified in the prompt instructions to delimit script output from agent instructions.
- Capability inventory: Executes shell scripts to retrieve provider metadata.
- Sanitization: No explicit sanitization or validation of the script output is performed before summarization.
Audit Metadata