writing-skills

Pass

Audited by Gen Agent Trust Hub on Feb 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The utility script render-graphs.js uses the child_process.execSync function to invoke the system command dot. This is used to render Graphviz diagrams defined within the markdown files into SVG images. While this facilitates workflow visualization, it involves the execution of external system processes based on content extracted from documentation.\n- [PROMPT_INJECTION]: The skill's testing methodology, detailed in examples/CLAUDE_MD_TESTING.md and testing-skills-with-subagents.md, utilizes explicit prompt injection patterns. These files employ framing such as 'IMPORTANT: This is a real scenario. Choose and act.' and 'Be honest.' to create high-pressure scenarios intended to override standard agent behavior. This is done to evaluate an agent's compliance with the documentation rules under simulated adversarial conditions.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 25, 2026, 08:50 AM