Skills
skills/alirezarezvani/claude-code-skill-factory/prompt-factory/Gen Agent Trust Hub

prompt-factory

Warn

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • EXTERNAL_DOWNLOADS (MEDIUM): The skill distribution is incomplete, missing the core logic scripts scripts/generate_prompt.py, scripts/validator.py, and scripts/optimizer.py which are referenced in the README and imported by scripts/batch_generator.py. This omission makes the skill's primary behavior unverifiable.
  • PROMPT_INJECTION (LOW): The script scripts/batch_generator.py is vulnerable to indirect prompt injection and path traversal as it processes external configuration data without sanitization or boundary markers. 1. Ingestion points: External CSV and JSON files accessed via the --input argument. 2. Boundary markers: Absent; no delimiters are used to wrap external content. 3. Capability inventory: Local file system writing using Path.write_text. 4. Sanitization: Absent; the name attribute from the input file is used to construct output paths without validation, presenting a path traversal risk.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 17, 2026, 06:08 PM