skillify
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes session history to generate new, persistent instruction files. This allows for the possibility of malicious instructions within the session being formalised into the agent's long-term behavior.\n
- Ingestion points: Processes session history and user-provided workflows within SKILL.md.\n
- Boundary markers: Includes a 'Quality Gate' check, but lacks strict technical delimiters or explicit instructions for the agent to ignore potentially malicious embedded content during extraction.\n
- Capability inventory: Has file-writing capabilities to specific configuration paths like
.omc/skills/and~/.claude/skills/.\n - Sanitization: No explicit sanitization or filtering logic is provided to verify the safety of the session content before it is written to a file.\n- [PERSISTENCE]: The skill's core function is to write new markdown files with YAML frontmatter to persistent storage directories such as
${CLAUDE_CONFIG_DIR:-~/.claude}/skills/. These files are loaded by the agent in future sessions, providing a mechanism for instructions to persist permanently in the agent's environment.
Audit Metadata