scrolls-hide
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell scripts (
hide.sh) and PowerShell scripts (hide.ps1) to automate file system operations such as directory renaming (usingmvorgit mv) and file content modification. These operations are restricted to the local workspace and intended for project maintenance. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with project-specific files (e.g.,
STARTER.md,SCROLLS.md) to update path references. Although this involves processing data from the local filesystem, the risk of the agent interpreting this content as malicious instructions is mitigated by the skill's specific functional scope and thedisable-model-invocation: trueconfiguration, which prevents the agent from using the output to trigger further model reasoning.
Audit Metadata