hypercognitive-skill-compiler
Pass
Audited by Gen Agent Trust Hub on Feb 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references documentation and tools from well-known and trusted sources, including
agentskills.io,opencode.ai, and the Vercel Labs repository on GitHub (github.com/vercel-labs/skills). These are documented as official resources for the Agent Skills ecosystem. - [COMMAND_EXECUTION]: The skill includes two utility Bash scripts (
scripts/generate-skill-template.shandscripts/validate-bundle.sh). These scripts use standard system utilities such assed,awk,find, andgrepto automate the creation and validation of skill packages. They include proper error handling (set -e) and do not execute external code. - [PROMPT_INJECTION]: The skill processes untrusted user input via the
SKILL_REQUEST_BUNDLEparameter, which is a potential surface for indirect prompt injection. - Ingestion points: Data enters through the
SKILL_REQUEST_BUNDLEinSKILL.md. - Boundary markers: The skill uses markdown headers and specific block structure (e.g.,
## 1. SKILL.md) to isolate the generated output. - Capability inventory: The skill uses search tools (
searxng) for research and generates executable Bash scripts as part of its output. - Sanitization: The skill explicitly includes defensive logic such as
mode_prompt_injection_defense,mode_security_threat_model, andmode_quality_gates_designto harden the generated skill against malicious input.
Audit Metadata