writing-skills

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The utility script render-graphs.js executes the system's dot command via child_process.execSync to generate SVG diagrams from Graphviz code blocks extracted from markdown files. This is a local visualization tool intended for skill authors.\n- [PROMPT_INJECTION]: The skill documentation incorporates strong imperative language and behavioral steering principles, such as Authority and Commitment, to ensure agent compliance with strict TDD workflows. While these linguistic patterns resemble those used in prompt injections, they are applied here to define internal operational discipline and process enforcement rather than to bypass safety guardrails.\n- [SAFE]: File system access is restricted to the skill's own directory and standard agent configuration paths (~/.claude/skills) for managing and documenting skills. No remote execution from untrusted sources, external data exfiltration, or hardcoded credentials were found.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 12:09 PM