create-stateful-skill
Warn
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
scaffold.py) via the Bash tool in Phase 2. The command interpolation uses user-supplied variables[requested-name]and[short-description]. While theevals.jsonfile includes a test case for preventing script injection, theSKILL.mdinstructions do not explicitly mandate sanitization or validation of these inputs before they are passed to the shell. - [REMOTE_CODE_EXECUTION]: The skill's architecture is built on numerous files in the
references/patterns/directory that contain relative paths pointing significantly outside the skill's own root directory (e.g.,../../../../../agent-skill-open-specifications/...). This indicates a dependency on a specific external repository structure, and the agent will attempt to load and execute logic from these unverifiable external paths. - [DATA_EXFILTRATION]: While no direct network tools are listed in
allowed-tools, the inclusion of theBashtool enables the possibility of data exfiltration if the environment allows outgoing connections, particularly if the user-supplied inputs for the scaffolding process are exploited for command injection.
Audit Metadata