prompt-optimizer
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONNO_CODEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The SKILL.md file contains instructions for the agent to execute shell commands (
python3 scripts/evaluate.pyandpython3 scripts/optimize.py) that pass user-supplied strings directly as command-line arguments. - [NO_CODE]: The skill references specific script files (
scripts/evaluate.py,scripts/optimize.py) to perform its primary functions, but these files were not included in the analysis package, making the actual logic unverifiable. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by design.
- Ingestion points: User-provided prompts are ingested via command-line arguments as seen in SKILL.md.
- Boundary markers: No explicit boundary markers or delimiters are defined in the instructions to isolate user input from the command execution.
- Capability inventory: The skill uses
python3to execute scripts that process user-provided data. - Sanitization: Specific sanitization or validation logic is not visible as the referenced scripts are missing.
Audit Metadata