learning-graph-generator

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the execution of various shell commands and Python scripts included in the package to perform its tasks.
  • Shell commands such as mkdir and cd are used for environment setup.
  • The skill executes python analyze-graph.py, python add-taxonomy.py, python csv-to-json.py, python taxonomy-distribution.py, and python3 validate-learning-graph.py to process data and generate reports.
  • [EXTERNAL_DOWNLOADS]: The skill references external resources for environment setup and validation.
  • It suggests cloning a template repository from https://github.com/dmccreary/intelligent-book-template if the local environment is not initialized.
  • The JSON schema and validation examples reference URLs on raw.githubusercontent.com and dmccreary.github.io for schema verification.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from an external file which serves as a potential vector for indirect prompt injection.
  • Ingestion points: The agent reads and assesses the content of course-description.md to generate concept labels and dependency mappings.
  • Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore potentially malicious instructions embedded within the course description file.
  • Capability inventory: The skill has the capability to execute shell commands, run local scripts, and write various file formats (.md, .csv, .json) to the project directory.
  • Sanitization: The instructions do not specify any sanitization or validation steps for the input text before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 06:32 PM