arc-system-design
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to execute code from the project directory to verify functionality. This involves spawning background processes and using shell commands like
curlto interact with the running application. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and acting upon untrusted data from the user's project files.
- Ingestion points: The agent reads state and instructions from
docs/progress.md,docs/<system>-design.md, and the project's source code files. - Boundary markers: No explicit delimiters or safety instructions are provided to the agent to treat the project files as untrusted; the agent is instead told to "Trust code on disk over the doc."
- Capability inventory: The skill possesses the ability to perform file system read/write operations, execute arbitrary shell commands (to start the app), and make network requests.
- Sanitization: There is no evidence of sanitization, validation, or filtering of the content read from the project files before it is used to influence the agent's behavior.
Audit Metadata