synthesis-skills-manager
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
release.pyandcache_guardian.pyscripts utilize thesubprocess.runmodule to execute a variety of system commands. These includegitoperations (pushing updates, tagging releases), running thepytestsuite for verification, and interacting with system service managers (launchctlandsystemctl). These actions are central to the skill's function as a release and lifecycle manager. - [PERSISTENCE]: The
cache_guardian.pyscript contains logic to install a background supervisor service using macOSLaunchAgentsand Linuxsystemduser units. This service is designed to monitor and rehydrate historical plugin cache roots if they are removed by the client application, ensuring the stability of ongoing agent sessions that may be pinned to specific version paths. - [INDIRECT_PROMPT_INJECTION]: The 'synthesis merge' workflow involves an AI agent reading and synthesizing instructions from external
SKILL.mdfiles during updates. This represents a potential surface for indirect prompt injection if the source repository content is untrusted. - Ingestion points: Reads
SKILL.mdfiles from source repositories during installation and drift resolution. - Boundary markers: Relies on standard Markdown and YAML structures; no specific adversarial boundary markers for the synthesis process are documented.
- Capability inventory: Includes file system modification, command execution via
subprocess, and background service management. - Sanitization: The synthesis process is described as a methodological comparison, but the script does not explicitly detail input sanitization for the Markdown content.
Audit Metadata