skill-expert
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external
SKILL.mdfiles and associated resources for auditing, improvement, and packaging. This creates a potential attack surface where instructions embedded in the audited data could attempt to influence the agent's behavior during the session. - Ingestion points: Reads files and references identified in the user's request for audit or improvement (SKILL.md).
- Boundary markers: The instructions focus on judging content but do not explicitly mandate the use of delimiters or 'ignore embedded instructions' warnings when handling the untrusted input.
- Capability inventory: The skill has the authority to read/write files and execute local scripts.
- Sanitization: No specific sanitization or escaping mechanisms for the audited content are defined.- [COMMAND_EXECUTION]: The skill uses local scripts (e.g.,
validate_skill_frontmatter.pyandcheck_leitworter.py) to perform validation tasks. It provides templates for executing bundled scripts using absolute path resolution to ensure stability across different host environments.- [DYNAMIC_CONTEXT_INJECTION]: The skill's authoring contract (references/authoring-contract.md) includes a security directive advising against the use of load-time command execution syntax (!command). This is a defensive design choice that mitigates risks associated with unintended code execution during the skill loading phase.
Audit Metadata