skill-developer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The guide describes a system architecture designed to ingest untrusted data, such as user prompts and file content, to trigger automated responses or guardrails.\n
- Ingestion points: Triggers are defined based on regex matching of user prompts (described in
TRIGGER_TYPES.md) and content within project files (described inSKILL_RULES_REFERENCE.md).\n - Capability inventory: The system includes the ability to inject text into the agent's prompt context and block specific tool executions, such as file edits, through hook mechanisms detailed in
HOOK_MECHANISMS.md.\n - Boundary markers: The documentation suggests using specific visual delimiters (e.g., box-drawing characters) for injected context to help the agent distinguish it from user input.\n
- Sanitization: The provided documentation focuses on matching patterns and does not explicitly address the sanitization or escaping of untrusted data before it is processed by the hooks.\n- [COMMAND_EXECUTION]: The skill documentation in
SKILL.mdandTROUBLESHOOTING.mdincludes shell command examples for developers to test their own local hook scripts usingnpx tsx. These commands are intended for local development and debugging of the skill system itself.\n- [PRIVILEGE_ESCALATION]: The troubleshooting guide inTROUBLESHOOTING.mdsuggests using standard file permission modifications (chmod +x) to ensure that local bash wrapper scripts for hooks can be executed by the development environment.
Audit Metadata