import-skills-to-skilder
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data (local
SKILL.mdfiles and companion scripts) that could potentially contain malicious instructions. - Ingestion points: Reads files from local directories such as
~/.claude/skills/,./.agents/skills/, and repository subdirectories. - Boundary markers: The instructions direct the agent to import content verbatim without rewriting or summarizing, which may allow embedded instructions in the imported files to influence the agent if not handled carefully by the platform.
- Capability inventory: The skill utilizes the
managetool (via the Skilder MCP server) to create new workspace entries and upload file content (references and scripts). - Sanitization: The skill explicitly mandates a check for secrets (API keys, tokens, passwords) before ingestion, skipping any files that appear to contain credentials.
- [DATA_EXFILTRATION]: The skill reads local filesystem data and transmits it to
app.skilder.ai. This behavior is consistent with the skill's stated purpose of centralizing local skills into a cloud workspace. The destination domain and the tool operator (skilder.ai) correspond to the skill's authoring organization. Risk is further mitigated by a mandatory user review of the inventory before the import process begins.
Audit Metadata