skill-selector
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
scripts/list_skills.py) to scan the filesystem and extract metadata from other skill files. - [INDIRECT_PROMPT_INJECTION]: The skill's core logic relies on analyzing untrusted workspace data to determine which skills to recommend.
- Ingestion points: Instructions in
SKILL.mdandreferences/curiosity-asking-guide.mddirect the agent to read open files, file extensions, imports, and project structure. - Boundary markers: No delimiters or warnings are provided to help the agent distinguish between its instructions and the potentially malicious data contained within analyzed files.
- Capability inventory: The agent uses results from this analysis to execute local tools and suggest specific workflows to the user.
- Sanitization: The skill does not instruct the agent to sanitize or ignore instructions found within the data it processes.
- [PROMPT_INJECTION]: The skill encourages the agent to bypass human oversight by instructing it to 'proceed with the recommendation based on your analysis' and stating that there is 'No need to ask the user for confirmation.' This autonomous behavior increases the risk that an attacker could influence the agent via content placed in the files it analyzes.
Audit Metadata