cmp
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides automated installation scripts (
scripts/install.shandscripts/install.ps1) that execute system-wide commands to install thecmputility. These scripts utilize various package managers includingapt-get,dnf,pacman,apk, andbrew. - [COMMAND_EXECUTION]: The
scripts/install.ps1script explicitly utilizessudoto gain elevated privileges when executing package management commands on Linux systems. - [PROMPT_INJECTION]: The skill processes untrusted external files for byte-level comparison, creating a surface for indirect prompt injection.
- Ingestion points:
SKILL.mdandreferences/cheatsheet.mddescribe using thecmpcommand on arbitrary file paths. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore or treat content within the compared files as untrusted data.
- Capability inventory: The skill includes scripts (
scripts/install.sh,scripts/install.ps1) that perform system-level command execution and privilege acquisition. - Sanitization: No sanitization or validation of the file content is performed before the tool processes the bytes.
Audit Metadata