utility-pm-skill-auditor

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a broad ingestion surface because its primary function is to audit the entire repository, including potentially untrusted content in documentation and other skill files.
  • Ingestion points: Processes CONTEXT.md, AGENTS.md, README.md, and all files within the repository scope during an audit pass.
  • Boundary markers: Absent; the instructions do not explicitly direct the agent to ignore or delimit instructions that might be embedded in the audited repository files.
  • Capability inventory: The skill can execute local bash scripts (scripts/pre-tag-validate.sh) and has broad file system read access.
  • Sanitization: Absent; there is no mention of escaping or validating the content of the repository files before they are processed by the auditor.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell scripts (bash scripts/pre-tag-validate.sh) to run its suite of enforcing validators. This is the primary intended behavior for this governance tool.
  • [DYNAMIC_EXECUTION]: The skill dynamically adopts its core system prompt by reading the file agents/pm-skill-auditor.md at runtime. This mechanism is used to ensure consistent behavior across different AI clients but involves loading instructions from a file outside of the skill manifest itself.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 06:21 AM
Security Audit — agent-trust-hub — utility-pm-skill-auditor