sjskills
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages and reconciles state from external sources such as sjskills.toml and remote GitHub repositories, which creates a surface for indirect prompt injection where malicious instructions could be embedded in fetched content.
- Ingestion points: Project configuration manifests (sjskills.toml) and remote skill trees fetched via Git or HTTPS (e.g., your-org/team-skills).
- Boundary markers: The skill relies on the sjskills tool's planning phase to identify and quarantine undeclared or modified directories, preventing automatic adoption of unknown content.
- Capability inventory: Execution of the sjskills CLI, git, and gh for state inspection, network fetching, and filesystem reconciliation.
- Sanitization: The tool performs provenance verification and placement checks to ensure the integrity of the skill components prior to deployment.
- [SAFE]: The skill enforces a strict security model for global state reconciliation, requiring cryptographic SHA-256 verification of plans and executables before any mutation occurs.
- [SAFE]: The tool correctly delegates credential management to the user's existing Git and GitHub CLI configurations, avoiding the exposure of secrets within the skill's instructions or configuration.
Audit Metadata