utility-pm-skill-auditor
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a broad ingestion surface because its primary function is to audit the entire repository, including potentially untrusted content in documentation and other skill files.
- Ingestion points: Processes
CONTEXT.md,AGENTS.md,README.md, and all files within the repository scope during an audit pass. - Boundary markers: Absent; the instructions do not explicitly direct the agent to ignore or delimit instructions that might be embedded in the audited repository files.
- Capability inventory: The skill can execute local bash scripts (
scripts/pre-tag-validate.sh) and has broad file system read access. - Sanitization: Absent; there is no mention of escaping or validating the content of the repository files before they are processed by the auditor.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell scripts (
bash scripts/pre-tag-validate.sh) to run its suite of enforcing validators. This is the primary intended behavior for this governance tool. - [DYNAMIC_EXECUTION]: The skill dynamically adopts its core system prompt by reading the file
agents/pm-skill-auditor.mdat runtime. This mechanism is used to ensure consistent behavior across different AI clients but involves loading instructions from a file outside of the skill manifest itself.
Audit Metadata