gskills-forge
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes 'gemini-forge' via package.json scripts and procedural instructions (e.g., 'gemini-forge check .'). This utility is attributed to the skill's author ('tercel') and is used for deployment and validation within the local environment.
- [DATA_EXPOSURE]: The skill performs directory listings ('list_directory') and file reads ('read_file') to audit and refactor existing skills within the workspace ('.gemini/skills/' or '.agents/skills/'). This access is standard for skill management tasks.
- [DYNAMIC_EXECUTION]: The '/new' and '/convert' commands generate new file structures and SKILL.md content based on established templates and user-provided inputs. This template-based generation is a standard feature for a scaffolding and migration utility.
- [INDIRECT_PROMPT_INJECTION]: The '/audit' and '/convert' commands ingest external skill files and instructions for processing. While this creates a potential attack surface for indirect prompt injection, the risk is mitigated by the skill's specific focus on architectural analysis and transformation rather than unvalidated execution.
Audit Metadata