regex-mastery
Warn
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the AI agent to automatically run shell commands (
ls) to probe the user's home directory across multiple potential paths (~/.claude/skills/,~/.agent/skills/, etc.) for other installed skills. This automated file system discovery occurs without user initiation and can reveal information about the user's local environment. - [EXTERNAL_DOWNLOADS]: The instructions direct the agent to suggest and execute the installation of additional remote content using the
npx skills addcommand, which involves fetching and running external code from an unverified repository. - [PROMPT_INJECTION]: The skill contains a behavioral instruction that requires the agent to start its first response with a specific emoji (๐งข), which is a form of instruction override that dictates the agent's output format.
Audit Metadata