database-engineering
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to automatically execute a directory listing command (
ls) upon its first activation. This is used to verify the presence of recommended companion skills by searching specific hidden directories such as~/.claude/skills/and~/.agent/skills/. - [EXTERNAL_DOWNLOADS]: The documentation and agent instructions recommend the installation of additional companion skills (e.g.,
backend-engineering,performance-engineering) from theAbsolutelySkilledrepository using thenpxpackage runner. - [DATA_EXPOSURE]: The execution of the
lscommand for the companion check results in the exposure of local filesystem metadata, specifically the names and existence of other installed agent skills, to the agent's context. - [PROMPT_INJECTION]: The skill includes an instruction to the agent to always start its first response with a specific emoji (🧢) upon activation. While this is an override of standard behavior, it is benign in nature.
Audit Metadata