skill-test

Warn

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill accesses the hidden directory ~/.claude/projects/ to append execution metadata to a skill-telemetry.md file. This path is used by the agent platform to store project-specific data and persistent context, making it a sensitive location for unauthorized writes or logging.
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and analyzes the full contents of untrusted external SKILL.md files. A malicious file processed by this skill could contain instructions intended to override the agent's behavior during the validation or dry-run simulation phases.
  • Ingestion points: Full text of SKILL.md files read from user-provided paths, skill names, or glob patterns in PHASE 1.
  • Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded directives in the analyzed content.
  • Capability inventory: File system read (PHASE 1), file system write/append (Telemetry section).
  • Sanitization: Absent; instructions are parsed and scored without filtering or escaping of the input text.
  • [COMMAND_EXECUTION]: The skill resolves user-supplied arguments (paths, names, globs) to file paths. While instructions specify resolving from a registry root, unvalidated path resolution can be a surface for directory traversal if the execution environment does not strictly enforce path boundaries.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 23, 2026, 10:58 AM
Security Audit — agent-trust-hub — skill-test