pavlo-agent-skill-creator
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the format specification HTML from the official project website at
https://agentskills.io/specificationusing a provided bash script. - [COMMAND_EXECUTION]: Includes a shell script (
scripts/fetch-specification.sh) that utilizescurlto download remote content into thereferences/directory. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, which could contain malicious instructions designed to influence the agent's behavior during the synchronization process.
- Ingestion points: The
scripts/fetch-specification.shscript downloads HTML content from a remote URL that the agent is then instructed to read and process. - Boundary markers: There are no specific boundary markers or delimiters defined for the fetched HTML content, though instructions advise the agent to extract only the main content.
- Capability inventory: The skill possesses the ability to perform network fetches (via
curl) and write files to the local file system (via agent instructions inreferences/synchronize-specification.md). - Sanitization: Content undergoes a manual conversion to Markdown by the agent, which acts as a non-executable processing step before the data is saved to
references/agentskills-specification.md.
Audit Metadata