aeon-doctor
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files (aeon.yml, .mcp.json) and markdown files (skills/*/SKILL.md) that may contain untrusted content. It uses these values in shell commands and regex patterns without explicit escaping, which could lead to logic manipulation or injection if a skill is maliciously named.
- Ingestion points: aeon.yml, skills/*/SKILL.md, and memory/logs/ (SKILL.md).
- Boundary markers: Absent; the skill does not use delimiters or warnings to separate untrusted data from processing logic.
- Capability inventory: Shell execution (bash, grep, awk, comm, ls, node), file reading, and notification via ./notify (SKILL.md).
- Sanitization: Absent; shell variables derived from file content are interpolated into command strings (e.g., in Check 12 of SKILL.md).
- [COMMAND_EXECUTION]: The skill is designed to execute multiple shell commands and local scripts (node scripts/validate-config.js, bash scripts/skill_requires.sh) to perform its primary function. While these are local vendor scripts, the reliance on shell execution for processing file-derived variables increases the attack surface.
Audit Metadata