clonedeps
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content by cloning external repositories into the local workspace for the agent to inspect. This data is then available in the agent's context, creating a surface for indirect prompt injection if the cloned source contains malicious instructions.\n
- Ingestion points: External code is cloned into
.slim/clonedeps/repos/usinggit clone(SKILL.md, Step 4).\n - Boundary markers: The skill instructions do not explicitly mandate delimiters or 'ignore instructions' warnings when the agent reads the cloned code, though it marks the area as read-only in AGENTS.md.\n
- Capability inventory: The skill can execute
gitcommands, write to the filesystem (.slim/,.gitignore,AGENTS.md), and perform network operations.\n - Sanitization: Includes checks for URL protocols, rejection of embedded credentials, and mandatory user approval before cloning (SKILL.md, Step 3).\n- [COMMAND_EXECUTION]: The workflow involves executing
gitcommands (ls-remote,clone,fetch) to interact with remote repositories. (SKILL.md, Step 4)\n- [EXTERNAL_DOWNLOADS]: The skill is designed to download source code from external URLs (GitHub, GitLab) provided by another tool or the user. (SKILL.md, Step 3 & 4)
Audit Metadata