asc-skills
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from the vendor's official repository at tddworks/asc-cli-skills on GitHub using the npx command to extend agent capabilities.
- [COMMAND_EXECUTION]: Executes shell commands including npx skills add, npx skills check, and npx skills update to manage the lifecycle of agent extensions.
- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it reads and parses metadata from files in the ~/.claude/skills/ directory.
- Ingestion points: Reads SKILL.md frontmatter from subdirectories in ~/.claude/skills/.
- Boundary markers: None identified to delimit ingested metadata from internal instructions.
- Capability inventory: Ability to execute shell commands via npx and remove directories via rm -rf.
- Sanitization: No explicit sanitization or schema validation of parsed metadata is described.
Audit Metadata