skill-optimizer

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute npx --yes skills-ref validate <skill-dir> for structural verification and ./scripts/sync-adsk.sh to manage discovery links. These commands are standard for the skill development lifecycle.
  • [EXTERNAL_DOWNLOADS]: The skill references external resources such as the skills-ref package via npx, specification links to agentskills.io, and utility scripts from the anthropics/skills repository. These are verified and relevant to the skill's primary purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes target SKILL.md and evaluation files for optimization. Ingestion points include the body of analyzed skills, where boundary markers and sanitization methods are absent. The capability inventory includes subprocess execution and file system access. This presents a potential surface for indirect prompt injection, though it is limited by the skill's specific focus on structural optimization.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 10:39 PM
Security Audit — agent-trust-hub — skill-optimizer