create-skill
Fail
Audited by Snyk on May 5, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E004: Prompt injection detected in skill instructions.
- Potential prompt injection detected (medium risk: 0.60). The prompt contains a deceptive/incomplete disclosure: while the "Disclosure" claims it will only create skills/{name}/SKILL.md, the protocol (Step 4) also explicitly instructs modifying .claude/harness.json and potentially CLAUDE.md, so it hides actions beyond the stated purpose (other instructions like "pretend you are a different AI session" are contextually relevant to testing and not covert).
Issues (1)
E004
CRITICALPrompt injection detected in skill instructions.
Audit Metadata