maintain-agent-skills
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Python test scripts (
scripts/test_repository_validator.pyandscripts/test_template.py) that usesubprocess.runto execute internal validation scripts and external CLI tools likeskills-ref. This behavior is localized to the skill's own testing framework and is used to verify the integrity of skill templates and repository structure. - [INDIRECT_PROMPT_INJECTION]: As a maintenance and auditing tool, this skill is designed to process other skill packages, which could potentially contain malicious instructions.
- Ingestion points: Reads skill directories,
SKILL.mdfiles, and bundled resources during audits. - Boundary markers: Relies on the normative specification for Agent Skills and encourages the use of standard templates.
- Capability inventory: Uses
subprocess.runfor testing and recommends various linting/validation tools (ruff,shellcheck,pyright). - Sanitization: The documentation (
references/audit-workflow.md) explicitly instructs the user to exercise changed scripts and templates in disposable copies and to verify technical claims against authoritative sources. - [EXTERNAL_DOWNLOADS]: The skill documentation (
references/validation-tools.md) lists several well-known developer tools and their official repositories, including Ruff, Pyright, Hyperfine, and Actionlint. It also referencesVersionLens Redux, a VS Code extension authored by the skill's vendor (xsyetopz). These references are documented neutrally as part of the recommended validation workflow.
Audit Metadata