kpi-dashboard-design
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The shell script
scripts/health-check.shimplements an argument handler using a template-like syntax${{1:?...}}. This input is stored in theSERVICE_URLvariable and echoed. The lack of validation on this input presents a potential command injection risk if the script is invoked with unsanitized external data containing shell metacharacters. - [INDIRECT_PROMPT_INJECTION]: The skill provides a mechanism to process external service URLs which could contain malicious instructions or shell escapes.
- Ingestion points: The
service_urlparameter inscripts/health-check.sh. - Boundary markers: Absent; there are no delimiters or "ignore" instructions for the provided URL.
- Capability inventory: Includes shell script execution (
scripts/health-check.sh) and data visualization logic. - Sanitization: Absent; the script does not validate that the input is a valid URL or escape characters before echoing.
Audit Metadata