sigil
Warn
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: MEDIUMDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill reference material (
reference/claude-code-skills-api.md) provides examples of using the!command`` syntax (dynamic context injection) that directly interpolate user-supplied positional arguments (e.g.,$1) into shell commands likegh pr view $1. This pattern is susceptible to command injection if the user provides malicious input containing shell metacharacters. - [INDIRECT_PROMPT_INJECTION]: The skill's core workflow relies on reading and analyzing arbitrary files from a repository to extract conventions and generate instructions. This process is vulnerable to indirect prompt injection, where malicious content embedded in the codebase (e.g., in configuration files or code comments) could influence the generated skill's behavior or override agent instructions.
- [COMMAND_EXECUTION]: The skill executes shell commands (e.g.,
git log,git branch,cat package.json) to analyze the project stack and structure. While these are used for the stated purpose of codebase understanding, the use of shell execution for context gathering expands the attack surface if the repository environment is maliciously crafted.
Audit Metadata