create-skill
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The 'Bulletproofing' section in SKILL.md instructs the agent to craft prompts that explicitly forbid 'rationalization' and ignore the 'spirit' of rules in favor of the 'letter.' These techniques are designed to create instructions that are highly resistant to an agent's internal safety reasoning or contextual overrides.\n- [COMMAND_EXECUTION]: The instructions guide the agent to perform shell commands for file system management (
mkdir -p), resource analysis (wc -w), and the execution of scripts (Python and Bash) stored within the skill's bundled resources.\n- [INDIRECT_PROMPT_INJECTION]: The skill serves as a generative framework for new agent instructions, creating a surface where untrusted user input can influence agent behavior.\n - Ingestion points: User-provided 'concrete examples' and functional requirements processed during the skill creation workflow (SKILL.md).\n
- Boundary markers: Absent. The templates provided for generated skills do not include specific delimiters or 'ignore embedded instructions' warnings for user-supplied content.\n
- Capability inventory: File system modification, shell command execution, and execution of local scripts (SKILL.md).\n
- Sanitization: Absent. The guide lacks instructions for validating or sanitizing user-provided domain knowledge or examples before they are written to new skill files.\n- [EXTERNAL_DOWNLOADS]: The skill references a GitHub repository (
github.com/obra/superpowers) for Graphviz styling conventions that is not included in the trusted vendors list.
Audit Metadata