shell-scripting
Warn
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill documentation includes an example command that accesses the sensitive system file
/etc/passwd. While intended to demonstrate text processing with specific delimiters, referencing sensitive system files is a risky practice as it normalizes accessing sensitive host data in shell commands.\n - Evidence:
awk -F: '{print $1}' /etc/passwd # Custom delimiterinSKILL.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides various patterns for ingesting and processing external data from sources like logs, CSV, and JSON files. This creates a surface for indirect prompt injection if an agent processes attacker-controlled data using these instructions without proper sanitization.\n - Ingestion points: File reading loops and text processing patterns in
SKILL.md(e.g.,while read -r line; do ... done < "$file",jq '.key' file.json).\n - Boundary markers: The examples do not include boundary markers or instructions to ignore embedded commands within the data.\n
- Capability inventory: The skill documents the use of powerful shell utilities including
find,grep,jq,awk,sed,mkdir, andrm.\n - Sanitization: There is no evidence of input validation or sanitization in the provided file processing examples.
Audit Metadata