skill-diff-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script located at
.agents/skills/platform/skill-lab.mjsto compare two files. This path refers to a platform-internal utility intended for skill management. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes content from external
SKILL.mdfiles provided as input. - Ingestion points: Two external files,
<old>/SKILL.mdand<new>/SKILL.md, are read as inputs for comparison. - Boundary markers: No specific boundary markers or 'ignore' instructions are used during the command-line invocation to handle potentially malicious content within the files.
- Capability inventory: The skill possesses the ability to execute a platform Node.js script and output a Markdown artifact summarizing the differences.
- Sanitization: No explicit validation or sanitization is performed on the content of the target files within the skill's instructions.
Audit Metadata