create-better-skill
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided descriptions and workflows to generate new instruction sets (SKILL.md files). This creates an attack surface where untrusted user input is interpolated into prompts. However, this is the primary intended function of the skill, and it includes a specific validation phase (Step 6) that explicitly checks for and forbids the inclusion of secrets, tokens, or absolute paths in the generated content.
- [SAFE]: The skill demonstrates security awareness by instructing the agent to validate the final output for sensitive data and by encouraging modularity (moving large data to reference files) rather than keeping it in the main executable prompt.
Audit Metadata