skill-dependency-graph
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script at
.agents/skills/platform/skill-lab.mjsto perform the graph generation and analysis tasks. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests and analyzes data from the canonical Skills directory.
- Ingestion points: Reads all files within the Skills directory to map dependencies.
- Boundary markers: None identified in the prompt logic to differentiate between skill metadata and potential embedded instructions.
- Capability inventory: The skill executes shell commands via Node.js but primarily outputs structured documentation or Mermaid diagrams.
- Sanitization: No explicit sanitization or filtering of the content read from skill files is mentioned.
Audit Metadata