pavlo-agent-skill-creator

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the format specification HTML from the official project website at https://agentskills.io/specification using a provided bash script.
  • [COMMAND_EXECUTION]: Includes a shell script (scripts/fetch-specification.sh) that utilizes curl to download remote content into the references/ directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, which could contain malicious instructions designed to influence the agent's behavior during the synchronization process.
  • Ingestion points: The scripts/fetch-specification.sh script downloads HTML content from a remote URL that the agent is then instructed to read and process.
  • Boundary markers: There are no specific boundary markers or delimiters defined for the fetched HTML content, though instructions advise the agent to extract only the main content.
  • Capability inventory: The skill possesses the ability to perform network fetches (via curl) and write files to the local file system (via agent instructions in references/synchronize-specification.md).
  • Sanitization: Content undergoes a manual conversion to Markdown by the agent, which acts as a non-executable processing step before the data is saved to references/agentskills-specification.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 10:30 AM