modern-c-makefile

Warn

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The Makefile templates include targets that execute shell commands with elevated privileges.
  • The setup target in references/gnaro_makefile.md and assets/cross_platform_guide.md uses sudo for system package management, including apt update, apt install, and a system-wide apt upgrade -y command.
  • The check target in references/gnaro_makefile.md executes the compiled project binary through valgrind using sudo, which grants the application root privileges during memory analysis.
  • [EXTERNAL_DOWNLOADS]: The skill provides templates that fetch installation and configuration scripts from external domains.
  • Fetches the LLVM setup script from apt.llvm.org.
  • References the official Homebrew installation script located on GitHub.
  • [REMOTE_CODE_EXECUTION]: The provided guides and reference files contain patterns for downloading and running remote scripts.
  • The setup target in the reference Makefile downloads llvm.sh and executes it using sudo.
  • The cross-platform guide for macOS includes a command that pipes a remote shell script directly from GitHub into a bash shell.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing and modifying external project files.
  • Ingestion points: The skill is intended to analyze and modify existing project Makefiles and source code as described in SKILL.md.
  • Boundary markers: There are no explicit instructions or delimiters provided to ensure the agent ignores potentially malicious instructions embedded in the processed user files.
  • Capability inventory: The skill possesses significant capabilities, including the ability to write files and execute system commands with elevated privileges via the generated Makefile targets.
  • Sanitization: No validation or sanitization of input files or the resulting shell commands is implemented.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 14, 2026, 08:58 AM