analytics-tracking
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface
- Ingestion points: Scanning of project root files (package.json, requirements.txt, etc.) in Phase 0 and user-provided $ARGUMENTS.
- Boundary markers: Absent. No delimiters or instructions to ignore embedded commands in processed data are provided.
- Capability inventory: The skill performs SDK installation via system package managers, creates/modifies source files, and executes project build/test scripts (SKILL.md).
- Sanitization: Absent. The explicit instruction to operate in 'AUTONOMOUS MODE' and 'Do NOT ask questions' removes the human-in-the-loop check that would typically mitigate malicious instructions embedded in the codebase.
- [COMMAND_EXECUTION]: The skill executes arbitrary package installation commands (e.g., npm, pip, pub, go) and project-defined build/test scripts based on its automated detection of the framework and environment.
- [DATA_EXFILTRATION]: The 'Self-Evolution Telemetry' section instructs the agent to write metadata about the skill's execution to a file at
~/.claude/projects/skill-telemetry.md. Writing data to a location outside the immediate project workspace is a persistence and data exposure risk, though limited here to specific platform-related paths.
Audit Metadata