ag2-shell-tool
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill introduces two tools,
SandboxShellToolandShellTool, which allow an agent to run shell commands.SandboxShellToolspecifically uses thesubprocessmodule to execute commands on the local filesystem. - [DYNAMIC_EXECUTION]: The tool is designed to execute arbitrary code and commands generated at runtime by the AI agent, which is a powerful but high-risk capability.
- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface where an agent might process and act upon malicious instructions embedded in files it reads.
- Ingestion points: The agent can use shell commands (e.g.,
cat,grep,ls) to read the contents of the local workspace (SKILL.md). - Boundary markers: The skill provides an
ignoreparameter to block access to specific files (e.g.,.env), but does not automatically enforce delimiters when processing data. - Capability inventory: The tools provide full shell access, including file manipulation, network policy configuration (for OpenAI containers), and subprocess spawning.
- Sanitization: The skill supports prefix-based whitelisting (
allowed), a read-only mode, and command timeouts to limit the impact of malicious inputs.
Audit Metadata