Skills
skills/podo/design-agent-skills/content-strategy/Gen Agent Trust Hub

content-strategy

Warn

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user and agent to download and install a 'full skill' from an untrusted third-party GitHub repository (Owl-Listener/designer-skills) using the npx skills add command. This represents a supply chain risk as the content of the remote repository is not verified.
  • [COMMAND_EXECUTION]: The instructions contain multiple shell commands intended for execution, including grep to read local files and npx to install software. It specifically highlights the use of the ! syntax to execute these commands directly within the agent's environment.
  • [COMMAND_EXECUTION]: The skill performs local file system checks using [ -e ... ] and grep on paths within the user's home directory (~/.agents/skills/) to determine its internal state.
  • [PROMPT_INJECTION]: The skill uses a 'Decision tree' to guide agent behavior towards executing shell commands and installation routines, which can be used to bypass typical manual installation workflows.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 16, 2026, 01:27 PM
Security Audit — agent-trust-hub — content-strategy