skill-template-generator
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Node.js script located at
.agents/skills/platform/skill-lab.mjsto generate and validate skill templates. This execution is confined to local platform-internal tooling and a sandbox directory.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by persisting user-provided data into files.\n - Ingestion points: User-supplied skill metadata (name, domain, description).\n
- Boundary markers: None present in the generated templates.\n
- Capability inventory: File writing via the platform's
skill-lab.mjstool.\n - Sanitization: No validation or filtering of user input is performed before file creation.
Audit Metadata