learning-graph-generator
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of various shell commands and Python scripts included in the package to perform its tasks.
- Shell commands such as
mkdirandcdare used for environment setup. - The skill executes
python analyze-graph.py,python add-taxonomy.py,python csv-to-json.py,python taxonomy-distribution.py, andpython3 validate-learning-graph.pyto process data and generate reports. - [EXTERNAL_DOWNLOADS]: The skill references external resources for environment setup and validation.
- It suggests cloning a template repository from
https://github.com/dmccreary/intelligent-book-templateif the local environment is not initialized. - The JSON schema and validation examples reference URLs on
raw.githubusercontent.comanddmccreary.github.iofor schema verification. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from an external file which serves as a potential vector for indirect prompt injection.
- Ingestion points: The agent reads and assesses the content of
course-description.mdto generate concept labels and dependency mappings. - Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore potentially malicious instructions embedded within the course description file.
- Capability inventory: The skill has the capability to execute shell commands, run local scripts, and write various file formats (.md, .csv, .json) to the project directory.
- Sanitization: The instructions do not specify any sanitization or validation steps for the input text before it is processed by the agent.
Audit Metadata