help
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill dynamically discovers other skills by scanning the filesystem and reading metadata from SKILL.md files. This metadata is then interpolated into the agent's output, creating a vector for instructions embedded in external skill files to influence the agent.
- Ingestion points: Metadata is read via Grep and Read tools from files located in ${CLAUDE_PLUGIN_ROOT}/skills and src/skills as specified in the SKILL.md logic.
- Boundary markers: The skill lacks delimiters or explicit instructions for the agent to treat the discovered metadata as untrusted data or to ignore embedded commands within descriptions.
- Capability inventory: The agent has access to Grep, Read, Glob, and AskUserQuestion tools which can be used to process and act upon discovered data.
- Sanitization: There is no evidence of filtering or sanitization of the description or tag fields before they are rendered in the category listings.
Audit Metadata