using-agent-skills
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill integrates with external documentation and uses a caching mechanism that ingests content from remote URLs into the agent's context. This creates a surface where malicious instructions in external docs could influence behavior. \n
- Ingestion points: WebFetch tool results and cached content served via a PreToolUse hook in
upstream-bundle/hooks/sdd-cache-pre.sh. \n - Boundary markers: The hook uses
----- BEGIN CACHED CONTENT -----and----- END CACHED CONTENT -----delimiters. \n - Capability inventory: The skill includes file modification, shell command execution (via
/build,/test), and version control operations. \n - Sanitization: No evidence of content sanitization for ingested documentation data. \n- [COMMAND_EXECUTION]: The skill provides shell hooks that perform network requests and manipulate local files. \n
- The
curlcommands insdd-cache-pre.shandsdd-cache-post.shtake URLs from tool inputs without using the--delimiter, potentially allowing argument injection if a maliciously crafted URL is processed. \n- [EXTERNAL_DOWNLOADS]: The documentation encourages downloading the plugin from GitHub and references various well-known services and documentation registries. \n - Plugin installation commands target the
addyosmani/agent-skillsrepository. \n- [DYNAMIC_EXECUTION]: Thesimplify-ignorehook dynamically modifies code files in the project workspace by replacing protected blocks with placeholders. \n - This constitutes dynamic environment manipulation through runtime script modification and restoration.
Audit Metadata