synthesis-skills-manager

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The release.py and cache_guardian.py scripts utilize the subprocess.run module to execute a variety of system commands. These include git operations (pushing updates, tagging releases), running the pytest suite for verification, and interacting with system service managers (launchctl and systemctl). These actions are central to the skill's function as a release and lifecycle manager.
  • [PERSISTENCE]: The cache_guardian.py script contains logic to install a background supervisor service using macOS LaunchAgents and Linux systemd user units. This service is designed to monitor and rehydrate historical plugin cache roots if they are removed by the client application, ensuring the stability of ongoing agent sessions that may be pinned to specific version paths.
  • [INDIRECT_PROMPT_INJECTION]: The 'synthesis merge' workflow involves an AI agent reading and synthesizing instructions from external SKILL.md files during updates. This represents a potential surface for indirect prompt injection if the source repository content is untrusted.
  • Ingestion points: Reads SKILL.md files from source repositories during installation and drift resolution.
  • Boundary markers: Relies on standard Markdown and YAML structures; no specific adversarial boundary markers for the synthesis process are documented.
  • Capability inventory: Includes file system modification, command execution via subprocess, and background service management.
  • Sanitization: The synthesis process is described as a methodological comparison, but the script does not explicitly detail input sanitization for the Markdown content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 12:52 AM