skill-update
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external learnings and observations to update its repository, creating a potential surface for indirect instructions. 1. Ingestion points: The Workflow('skill-update', { learnings: [...] }) mechanism in SKILL.md accepts external text data. 2. Boundary markers: The skill employs a four-gate promotion test and blind refuters using logic in .claude/workflows/lib/wf-helpers.mjs. 3. Capability inventory: The skill triggers local script execution (e.g., skill_linter.py) and file-writing operations via the workflow engine. 4. Sanitization: Mandates a machine scrub and the use of placeholders like <TARGET_IP> or to remove target-specific lore.
- [COMMAND_EXECUTION]: The skill instructions encourage the execution of local Python scripts and shell commands for validation and setup. Evidence: Mentions running python scripts/skill_linter.py, python scripts/analyze_form.py, and python scripts/validate_fields.py across several files. Evidence: reference/STRUCTURE.md includes a bash script for automated directory structure scaffolding.
Audit Metadata