audit-skill

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the npx skills CLI to perform global management tasks, including listing and installing skills for specific agent environments like Codex, Gemini CLI, and Cursor.
  • [EXTERNAL_DOWNLOADS]: Skill definitions are retrieved from the vendor's GitHub repository (onfloukimson/devkimson-skills), which is a standard source for synchronizing the author's own toolset.
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to the ingestion of external repository content. Ingestion occurs from devkimson-skills (specifically within the skills/ directory) without explicit boundary markers or content sanitization, facilitating the intended global installation of those tools.
  • [REMOTE_CODE_EXECUTION]: The npx skills add workflow involves the automated retrieval and installation of skill content from the remote repository for use by agent environments, consistent with the skill's core administrative goals.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 09:36 AM
Security Audit — agent-trust-hub — audit-skill