skill-provenance
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions involve executing a local script
fdk/tools/skill-provenance.pyviapython3. These commands are used to perform administrative tasks such as recording skill metadata, calculating checksums, and performing integrity checks during Continuous Integration (CI) workflows. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it reads and processes all files within individual skill directories (
skills/<name>/) to calculate SHA256 checksums. - Ingestion points: Files located within the
skills/directory structure are read during thecheckandrecordoperations. - Boundary markers: Not explicitly defined in the provided markdown instructions.
- Capability inventory: The skill utilizes local script execution and file system read/write access (specifically writing to
fdk/skills.provenance.json). - Sanitization: Not specified, as the primary operation is cryptographic hashing for integrity verification.
Audit Metadata