gm-skill-manager
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with local CLI tools including
codex,claude, andnpxvia thesubprocess.runfunction. These calls are used to list, install, and configure plugins within their respective runtimes as part of the skill's primary management function. - [DATA_EXFILTRATION]: The skill reads local configuration files and directories, such as
~/.claude/plugins/installed_plugins.json,~/.codex/config.toml, and~/.agents/.skill-lock.json. This access is necessary to generate a unified inventory of installed skills. The skill includes aredact_inventoryutility that proactively removes sensitive information like passwords, tokens, and local paths from its generated reports. - [PROMPT_INJECTION]: During the discovery phase, the skill reads and summarizes the metadata (e.g., the
namefield) fromSKILL.mdfiles of other skills found on the system. This creates a surface for indirect prompt injection if an ingested skill contains malicious instructions designed to influence the agent's interpretation of the inventory report.
Audit Metadata