skill-preflight-ast-check
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions explicitly list jailbreak and override markers such as '<|im_start|>', '[SYSTEM]', and 'Ignore previous instructions' as targets for its security checks. While these are used in the context of detection rules, their inclusion in the skill's instructions creates a risk of triggering a behavioral override in the agent executing the audit.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted third-party agent skills from external repositories, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: External community repositories, Python scripts, and markdown files (SKILL.md) ingested for AST analysis.
- Boundary markers: The skill mentions regex-based identification of injection tokens but does not define strict data-vs-instruction delimiters for the content it processes.
- Capability inventory: The skill has access to powerful tools including 'execute_command', 'read_file', 'write_file', 'run_tests', and 'run_build'.
- Sanitization: There is no specified logic for sanitizing or escaping the untrusted content before it is processed by the agent, relying instead on detection of known tokens.
Audit Metadata