scamper
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided input through the $ARGUMENTS placeholder in SKILL.md.
- Ingestion points: User input via the command arguments is interpolated into the ideation prompt in SKILL.md.
- Boundary markers: Double quotes are used around the interpolated input: "$ARGUMENTS".
- Capability inventory: The skill does not define any tool usage, file system access, or network operations.
- Sanitization: No explicit sanitization or filtering of the user input is performed before interpolation.
- [EXTERNAL_DOWNLOADS]: The README.md file points to the author's GitHub repository for installation and skill packaging.
- Details: Provides a link to https://github.com/synapseradio/ai-skills/raw/main/packaged/scamper.skill for manual installation.
- Details: Mentions an installation command using npx targeting the repository https://github.com/synapseradio/ai-skills.
Audit Metadata