help
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill functions as a documentation system for the local workspace. It provides guided discovery through interactive questions and structured tables describing workspace capabilities.\n- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to dynamically list and describe available skills and agents. It performs directory traversal and file reading using standard utilities likeheadandgrepto extract metadata from.claude/skills/and.claude/agents/. These operations are limited to the workspace's configuration directory and are used purely for informational purposes.\n- [INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it reads and displays metadata (names and descriptions) from other local skill and agent files.\n - Ingestion points: Reads metadata from
.claude/skills/*/SKILL.mdand.claude/agents/*.md.\n - Boundary markers: No explicit markers are used to separate the ingested metadata from the agent's instructions, though it is displayed as documentation.\n
- Capability inventory: The skill has access to
AskUserQuestion,Bash,Read,Glob, andGrep.\n - Sanitization: Content is filtered for specific frontmatter keys (
name,description) usinggrep, which limits the scope of ingested data to specific structural fields.
Audit Metadata