add-flavor
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run
make megalinter-build. This is a standard build command within the MegaLinter repository used to generate Dockerfiles and metadata from project descriptors. - [PROMPT_INJECTION]: The skill utilizes a user-supplied
$ARGUMENTSvariable to name the new flavor and construct file paths (e.g.,flavors/$ARGUMENTS/). This represents an indirect prompt injection surface where untrusted user input is interpolated into paths used by the agent's tools. - Ingestion points: The
$ARGUMENTSparameter provided by the user (file: SKILL.md). - Boundary markers: None present.
- Capability inventory: Bash, Write, Edit, Read, Grep, Glob (across SKILL.md).
- Sanitization: The instructions do not specify validation or sanitization for the flavor name to prevent shell metacharacter injection or path traversal.
Audit Metadata