trainer-train-skill
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external
SKILL.mdfiles and training datasets. Malicious instructions embedded in these targets could potentially influence the training process or the behavior of optimization tools. - Ingestion points: Reads
SKILL.mdtarget files,datasets/train.jsonl, andevals/evals.jsonfrom the workspace. - Boundary markers: Implements a 'two-concern separation' routing table and a spec-compliance checklist in
references/skill-loop-contract.mdto strictly define the scope of modifications. - Capability inventory: Performs file-write operations to update target skills and executes shell-based validation commands.
- Sanitization: Includes a specific requirement to check that 'Skill contents must not contain executable exploit patterns' before writing back changes.
- [COMMAND_EXECUTION]: The workflow requires executing a validation command provided by the caller (e.g.,
python -m pytest) to confirm the candidate's validity. While this is the intended purpose of the skill, it involves executing shell commands against the project workspace.
Audit Metadata