custom-skills-tool-overlap-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes the content of various project files, including agents, skills, and command definitions. This creates an attack surface where malicious instructions embedded in a project file could potentially influence the agent's behavior during the analysis or report generation process.
- Ingestion points: The skill reads files from
.claude/agents/,skills/,.claude/skills/,commands/, and**/*.workflow.yamlduring Step 1 (Discovery) and Step 3 (Deep Analysis). - Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are provided to separate the analyzed content from the agent's internal logic.
- Capability inventory: The skill utilizes
grepfor project-wide searches and has the ability to write reports to thedocs/report/directory. - Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed for semantic comparison.
Audit Metadata