thrifty-execute

Warn

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is instructed to execute a 'gate command' that is provided as a runtime variable from an external orchestrator. This allows the execution of arbitrary shell commands within the host environment.
  • [COMMAND_EXECUTION]: The skill contains logic to 'self-fix' its own code and re-run the gate command up to three times, which involves dynamic code generation and execution without human oversight or validation.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from CONTRACT.md and various unit briefs, treating their 'Approach' sections and rules as binding instructions. This creates an indirect prompt injection surface where malicious content in these files can control the agent's actions. Ingestion points: CONTRACT.md and briefs/UNIT-NNN.md within the working directory. Boundary markers: None present; the files are explicitly described as binding rules. Capability inventory: File system write access (partition, relay, and layered modes) and arbitrary shell command execution. Sanitization: No validation, escaping, or filtering of the file contents or the command string is performed.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 30, 2026, 12:23 AM
Security Audit — agent-trust-hub — thrifty-execute