make-skill
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill captures conversation history to generate new skill manifests, creating an indirect prompt injection surface. (1) Ingestion points: User conversation, troubleshooting workflows, and session history. (2) Boundary markers: Relies on the materialize_skill tool's security scanner; no explicit markers are mentioned for the output manifest. (3) Capability inventory: Generated skills can perform file operations and execute shell commands. (4) Sanitization: The instructions do not define methods to sanitize or escape user-provided data before it is embedded in the new skill manifest.
- [COMMAND_EXECUTION]: The skill generates and executes dynamic scripts to automate workflows. Evidence includes instructions to write Python and Shell scripts to a local directory and execute them via shell commands or the run_tool_batch system. Commands are constructed dynamically using variables and tool outputs.
Audit Metadata