skillsmp
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and displays metadata from a large external index of over 1.6 million agent skills. This creates a surface for indirect prompt injection where a malicious skill author could include instructions in their skill's description intended to hijack the agent's behavior.
- Ingestion points: External skill data is fetched from the SkillsMP API (
https://skillsmp.com/api/v1/skills/search) inscripts/search.mjsandscripts/treasure.mjs. - Boundary markers: The skill does not use specific delimiters or instructions to the AI to ignore embedded commands within the fetched descriptions.
- Capability inventory: The skill has permissions to read local files (for API key management) and perform network requests to the vendor's API.
- Sanitization: The scripts normalize whitespace and truncate long descriptions but do not sanitize or escape the content for prompt safety.
- [COMMAND_EXECUTION]: The documentation suggests the use of
npx @yan-labs/skillsmp loginto manage API credentials. This command downloads and executes a package from the author's registry. As this is a vendor-owned resource, it is a standard functional component but involves remote package execution.
Audit Metadata