mthds-build
Pass
Audited by Gen Agent Trust Hub on Mar 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
mthds-agentCLI extensively to perform validation, convert JSON specs to TOML, and assemble the final method bundle. These commands are executed via subprocesses throughout the 10-phase build process. - [EXTERNAL_DOWNLOADS]: In Phase 0, the skill suggests installing or upgrading the
mthdspackage usingnpm install -g mthds. This is a vendor-owned resource necessary for the skill's primary purpose. - [PROMPT_INJECTION]: The 'Existing Method Detection' routine presents an indirect prompt injection surface. The skill performs a glob search for
**/*.mthdsfiles and reads their headers (domain and description) to compare them with the user's request. Ingestion points: Phase 'Existing Method Detection' inSKILL.md. Boundary markers: Absent. Capability inventory:mthds-agentCLI shell commands and file writing via the Write tool. Sanitization: No explicit sanitization of header content before processing. - [DATA_EXPOSURE]: The skill reads existing
.mthdsfiles to check for overlap and writes new method bundles to themthds-wip/directory. These actions are restricted to the local workspace and intended for the method construction process.
Audit Metadata