Command Development
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous examples of shell command usage (e.g.,
git,npm,kubectl,gh) intended for development workflows. These are provided as educational templates within Markdown code blocks and are not executed by the skill itself. - [DYNAMIC_CONTEXT_INJECTION]: The skill documents the platform-specific
!command`` syntax used for dynamic context injection. It correctly describes how this feature works to help developers build context-aware commands without triggering any malicious or unintended executions within its own instructions. - [INDIRECT_PROMPT_INJECTION]: The skill proactively addresses command injection risks by teaching 'Validation Patterns'. It provides examples of using
grepandtestto sanitize user-supplied arguments before they are passed to shell commands. - [COMMAND_EXECUTION]: Static analysis identified the use of
ddandrminreferences/testing-strategies.md. Upon review, these are benign examples used for creating dummy test files in/tmpand cleaning them up afterward during a standard testing workflow.
Audit Metadata