help

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill functions as a documentation system for the local workspace. It provides guided discovery through interactive questions and structured tables describing workspace capabilities.\n- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to dynamically list and describe available skills and agents. It performs directory traversal and file reading using standard utilities like head and grep to extract metadata from .claude/skills/ and .claude/agents/. These operations are limited to the workspace's configuration directory and are used purely for informational purposes.\n- [INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it reads and displays metadata (names and descriptions) from other local skill and agent files.\n
  • Ingestion points: Reads metadata from .claude/skills/*/SKILL.md and .claude/agents/*.md.\n
  • Boundary markers: No explicit markers are used to separate the ingested metadata from the agent's instructions, though it is displayed as documentation.\n
  • Capability inventory: The skill has access to AskUserQuestion, Bash, Read, Glob, and Grep.\n
  • Sanitization: Content is filtered for specific frontmatter keys (name, description) using grep, which limits the scope of ingested data to specific structural fields.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 05:10 PM
Security Audit — agent-trust-hub — help