skill-management
Warn
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
npxto download and execute packages from arbitrary, user-specified repositories (npx --yes skills add <owner/repo>), which can lead to the execution of untrusted code.\n- [EXTERNAL_DOWNLOADS]: The skill performsgit cloneoperations on repository URLs provided by the user, downloading external code into the agent's environment without integrity verification.\n- [PROMPT_INJECTION]: The skill instructions for 'Same-Session Use' create a significant surface for indirect prompt injection (Category 8).\n - Ingestion points: Untrusted
SKILL.mdfiles imported from external GitHub repositories into the.claude/skills/directory.\n - Boundary markers: Absent; the skill explicitly recommends injecting the raw content at the top of the task prompt.\n
- Capability inventory: Includes shell command execution via
npx,git,rm,cp, andpython3, as well as file system modification.\n - Sanitization: Absent; no validation or escaping of the imported markdown content is performed before injection.\n- [COMMAND_EXECUTION]: The skill executes multiple shell commands (
find,cp,rm,python3) that process paths and names derived from external sources, posing a risk of command injection if the recommended validation steps are bypassed.
Audit Metadata