Command Development
Pass
Audited by Gen Agent Trust Hub on Mar 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation and example files (including
SKILL.md,examples/simple-commands.md, andexamples/plugin-commands.md) contain extensive examples of bash commands using the!\syntax. These include common development tools such asgit,npm,gh(GitHub CLI),kubectl, andnode. These are provided strictly for educational purposes to demonstrate how to integrate system context into slash commands. - [EXTERNAL_DOWNLOADS]: The documentation in
references/marketplace-considerations.mdreferences official download locations for standard technology tools like Git, jq, and Node.js to assist users in setting up their environments. - [PROMPT_INJECTION]: The skill explicitly discusses the mechanics of slash commands as instructions for the AI agent. It provides guidance on how to structure these prompts and emphasizes security best practices, such as using the most restrictive
allowed-toolssettings and validating user inputs to prevent accidental or malicious behavior in custom commands. - [DATA_EXFILTRATION]: The skill documentation explains the usage of the
@syntax to read file contents into the agent's context. This is presented as a fundamental feature for creating context-aware tools, and the skill provides instructions on how to handle file references safely.
Audit Metadata