base
Warn
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill defines a credentials management workflow that instructs the agent to proactively ask for and read a centralized access file (e.g.,
~/Documents/Access.txt) to extract sensitive API keys for OpenAI, Anthropic, Render, and others. - [COMMAND_EXECUTION]: The TDD Execution workflow instructs the agent to execute shell commands (e.g.,
npm test,pytest) extracted directly from todo log tables within project Markdown files (_project_specs/todos/active.md). - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and acts upon instructions (atomic todos and bug reports) from project data files. These files can contain malicious commands in the 'TDD Execution Log' which the agent is instructed to execute without sanitization.
- Ingestion points:
_project_specs/todos/active.md,_project_specs/features/*.md. - Boundary markers: None present to distinguish between task metadata and potentially malicious instructions.
- Capability inventory: Subprocess execution of development tools (
npm,pytest,ruff,mypy,tsc) and file system access. - Sanitization: No validation or filtering is specified for the commands before execution.
Audit Metadata