interactive-tutorial-builder
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local platform script located at
.agents/skills/platform/skill-lab.mjs. This script is executed via Node.js to generate the tutorial framework based on the provided skill name.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (learner-contextandskill-name) to derive learning goals and checkpoints.\n - Ingestion points: Data is ingested through the
skill-nameandlearner-contextinputs defined in the frontmatter.\n - Boundary markers: None are explicitly defined to isolate user inputs within the prompt construction.\n
- Capability inventory: The skill executes a local platform script and generates instructional text for the learner.\n
- Sanitization: No input sanitization is performed within the skill instructions, relying on the underlying script's implementation.
Audit Metadata