audit-skill
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
npx skillsCLI to perform global management tasks, including listing and installing skills for specific agent environments like Codex, Gemini CLI, and Cursor. - [EXTERNAL_DOWNLOADS]: Skill definitions are retrieved from the vendor's GitHub repository (
onfloukimson/devkimson-skills), which is a standard source for synchronizing the author's own toolset. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to the ingestion of external repository content. Ingestion occurs from
devkimson-skills(specifically within theskills/directory) without explicit boundary markers or content sanitization, facilitating the intended global installation of those tools. - [REMOTE_CODE_EXECUTION]: The
npx skills addworkflow involves the automated retrieval and installation of skill content from the remote repository for use by agent environments, consistent with the skill's core administrative goals.
Audit Metadata