skill-forge
Warn
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill implements a shell-based 'PreToolUse' hook and provides a validation script ('scripts/validate-skill.sh'). Both components process user-controlled strings (file contents in the hook and directory paths in the script) using shell interpolation. Specifically, the hook uses '$TOOL_INPUT' in an 'echo' command, and the script uses '$SKILL_DIR' inside a 'python3' call, both of which could lead to command injection if variables are not sanitized by the host platform.
- [PROMPT_INJECTION]: Phase 1A (URL research) involves crawling untrusted external URLs to generate skill content. This ingestion of external data without explicit sanitization or boundary markers provides a vector for Indirect Prompt Injection. (1) Ingestion points: Phase 1A URL research; (2) Boundary markers: Absent; (3) Capability inventory: File system write access in Phase 6; (4) Sanitization: Absent.
- [EXTERNAL_DOWNLOADS]: The skill's primary function is to fetch documentation and metadata from remote servers to construct new AI agent skills.
Audit Metadata