modern-c-makefile
Warn
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Makefile templates include targets that execute shell commands with elevated privileges.
- The
setuptarget inreferences/gnaro_makefile.mdandassets/cross_platform_guide.mdusessudofor system package management, includingapt update,apt install, and a system-wideapt upgrade -ycommand. - The
checktarget inreferences/gnaro_makefile.mdexecutes the compiled project binary throughvalgrindusingsudo, which grants the application root privileges during memory analysis. - [EXTERNAL_DOWNLOADS]: The skill provides templates that fetch installation and configuration scripts from external domains.
- Fetches the LLVM setup script from
apt.llvm.org. - References the official Homebrew installation script located on GitHub.
- [REMOTE_CODE_EXECUTION]: The provided guides and reference files contain patterns for downloading and running remote scripts.
- The
setuptarget in the reference Makefile downloadsllvm.shand executes it usingsudo. - The cross-platform guide for macOS includes a command that pipes a remote shell script directly from GitHub into a
bashshell. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing and modifying external project files.
- Ingestion points: The skill is intended to analyze and modify existing project Makefiles and source code as described in
SKILL.md. - Boundary markers: There are no explicit instructions or delimiters provided to ensure the agent ignores potentially malicious instructions embedded in the processed user files.
- Capability inventory: The skill possesses significant capabilities, including the ability to write files and execute system commands with elevated privileges via the generated Makefile targets.
- Sanitization: No validation or sanitization of input files or the resulting shell commands is implemented.
Audit Metadata