skill-maker
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and update agent extensions from the vercel-labs/skills repository on GitHub. These operations are conducted against a trusted organization as part of a standard package management workflow.
- [COMMAND_EXECUTION]: Instructions guide the agent to execute standard development commands, including git (commit, push, mv), file system management, and the agnix linter tool.
- [PERSISTENCE]: The skill suggests configuring SessionStart hooks to automatically refresh local skills from remote sources at the start of every session. This is a platform-native mechanism for keeping extensions synchronized.
- [INDIRECT_PROMPT_INJECTION]: The skill body contains guidance for developers on how to prevent argument-based command corruption during skill execution, focusing on the safe handling of variable interpolation.
Audit Metadata