store-photoshoot
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to take metadata retrieved from external storefronts (such as product titles and SKUs) and use it directly as arguments in shell commands for the astria CLI. This creates a potential command injection vulnerability if the storefront data contains shell metacharacters.
- [DYNAMIC_EXECUTION]: Untrusted data from the store crawl is dynamically interpolated into shell command strings (e.g., astria tunes create --title ), which is a form of unsafe dynamic command construction.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted product data from Shopify and WooCommerce stores to generate AI image prompts. Ingestion points: Shopify and WooCommerce API endpoints (SKILL.md). Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to ignore potential commands embedded in the product data. Capability inventory: The agent has access to Bash(astria:), Bash(python3:), and Bash(curl:*) tools (SKILL.md). Sanitization: The instructions suggest stripping HTML from body_html but do not specify sanitization for other fields used in prompts or shell commands.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to crawl store URLs and download product images from external CDNs to be used as training data.
Audit Metadata