skills/mthds-ai/skills/mthds-build/Gen Agent Trust Hub

mthds-build

Pass

Audited by Gen Agent Trust Hub on Mar 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the mthds-agent CLI extensively to perform validation, convert JSON specs to TOML, and assemble the final method bundle. These commands are executed via subprocesses throughout the 10-phase build process.
  • [EXTERNAL_DOWNLOADS]: In Phase 0, the skill suggests installing or upgrading the mthds package using npm install -g mthds. This is a vendor-owned resource necessary for the skill's primary purpose.
  • [PROMPT_INJECTION]: The 'Existing Method Detection' routine presents an indirect prompt injection surface. The skill performs a glob search for **/*.mthds files and reads their headers (domain and description) to compare them with the user's request. Ingestion points: Phase 'Existing Method Detection' in SKILL.md. Boundary markers: Absent. Capability inventory: mthds-agent CLI shell commands and file writing via the Write tool. Sanitization: No explicit sanitization of header content before processing.
  • [DATA_EXPOSURE]: The skill reads existing .mthds files to check for overlap and writes new method bundles to the mthds-wip/ directory. These actions are restricted to the local workspace and intended for the method construction process.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 14, 2026, 02:32 AM