agentuity-cli-cloud-keyvalue-keys
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
bunxto download and execute the@agentuity/clipackage from the public NPM registry at runtime.- [COMMAND_EXECUTION]: The skill executes shell commands (e.g.,bunx @agentuity/cli kv keys) to interact with the Agentuity cloud platform, which is the primary intended function.- [INDIRECT_PROMPT_INJECTION]: The skill interpolates a user-supplied namespace name (<name>) directly into a shell command, creating a surface for potential command injection if the input is not sanitized. - Ingestion points: The
<name>argument defined in theSKILL.mdfile. - Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore instructions embedded within the namespace name.
- Capability inventory: The skill has the capability to execute shell commands and perform network operations via the CLI tool.
- Sanitization: No sanitization or validation logic is provided in the skill instructions to handle special shell characters in the
<name>argument.
Audit Metadata