knowledge-generate
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes
npx skills addto install additional tools and extensions into the agent's local environment based on the configuration found in the project manifest. - [EXTERNAL_DOWNLOADS]: Functional extensions are fetched from the author's GitHub repository (
paucasanellas/knowledge.md) during the synchronization process. - [PROMPT_INJECTION]: The skill processes natural language instructions in the body of the
KNOWLEDGE.mdfile, treating them as binding configuration rules for its generation logic. - Ingestion points: The Markdown body of the
KNOWLEDGE.mdmanifest (Paso 6). - Boundary markers: The skill does not define specific delimiters for separating user content from instructions in the manifest body, though it requires user confirmation for non-read-only commands.
- Capability inventory: Writing to the file system (creating hubs and folders), executing shell commands via
npx, and modifying agent memory files (CLAUDE.mdandAGENTS.md). - Sanitization: No specific sanitization or filtering logic is described for the instructions interpreted from the Markdown body.
Audit Metadata