tapd-bug-analyzer
Warn
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external TAPD bug descriptions and uses that content to construct shell commands.
- Ingestion points: Data is fetched via the
mcp__mcp-server-tapd__get_bugtool, specifically from thedescriptionfield of the bug ticket. - Boundary markers: None are present in the instructions to prevent the agent from interpreting instructions embedded within the bug report.
- Capability inventory: The skill has the capability to execute shell commands via a hardcoded Python path (
~/.claude/skills/sls-trace-analyzer/.venv/bin/python). - Sanitization: While there is a regex for
traceId([a-f0-9]{16}), the 'Strategy B' allows for the extraction and direct usage of a 'Complete URL' in a shell command, which could be exploited for command injection if the URL contains shell metacharacters. - [COMMAND_EXECUTION]: The skill explicitly instructs the agent to run a shell command calling a local script (
sls-query.py) using arguments derived from untrusted external input. - Evidence: The instructions in Step 3 (Strategy A and B) show the construction of a CLI command:
~/.claude/skills/sls-trace-analyzer/.venv/bin/python ~/.claude/skills/sls-trace-analyzer/sls-query.py --trace-id "<traceId>" --region "<region>" --env "<env>". The reliance on fixed paths in~/.claude/skills/is a dependency on external code outside the skill's own directory.
Audit Metadata