skill-provenance
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a workflow for executing a local script
fdk/tools/skill-provenance.pyusing the Python interpreter. This is the intended functionality for auditing skill sources and verifying file integrity. - [PROMPT_INJECTION]: The skill's instructions document an interface where skill names and repository URLs are provided as arguments to shell commands. While this presents an interpolation surface (indirect prompt injection), it is a standard pattern for the skill's primary purpose of security auditing.
- Ingestion points: Skill names and source URL parameters within
SKILL.mdinstructions. - Boundary markers: None present in the command examples.
- Capability inventory: Execution of the local
skill-provenance.pyscript viapython3subprocesses. - Sanitization: Not explicitly detailed in the instructional markdown.
Audit Metadata