update-allowed-tools
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted content by reading and parsing other skill files and scripts to determine their permission requirements.
- Ingestion points: Files are read from the local filesystem (including ~/.claude/skills/ and the current working directory) as specified in Step 2.
- Boundary markers: No explicit delimiter-based boundary markers are described for the ingestion of the target skill's content.
- Capability inventory: The skill has the ability to modify filesystem content via Edit(**/SKILL.md) as defined in Step 6.
- Sanitization: The skill contains robust logic to filter out dangerous permission grants. Step 5 explicitly identifies 'inert' entries, such as protected paths (e.g., .ssh, .bashrc) and arbitrary code execution patterns (e.g., Bash(*)), ensuring they are removed or not added to the target skill's configuration.
Audit Metadata