skill-quality-dashboard

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/check.py utilizes the subprocess.run method to invoke internal validation tools and the aggregator script. These operations are performed using a fixed list of arguments and absolute file paths derived from the skill's directory structure, preventing command injection or execution of arbitrary code.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JSON data from the docs/public/generated-reports/ directory to generate its summary. While this provides a surface for indirect prompt injection, the skill treats the input as structured data and does not perform any security-sensitive operations based on the content of these reports.
  • Ingestion points: docs/public/generated-reports/*.json read by aggregate_reports.py.
  • Boundary markers: None explicitly present in the data processing logic.
  • Capability inventory: Limited to local file reads and standard output printing.
  • Sanitization: Uses standard json.loads for parsing, ensuring data is processed as a dictionary rather than executable code.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 06:15 AM
Security Audit — agent-trust-hub — skill-quality-dashboard