basercms-security-advisory
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes security advisory metadata and descriptions fetched from external sources (GitHub API), which represents a surface for indirect prompt injection if an adversary can influence the advisory text.
- Ingestion points: Advisory summaries and descriptions are fetched in
scripts/fetch-advisory.shandscripts/list-advisories.shusing the GitHub CLI API. - Boundary markers: Content is printed directly to the agent's context without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill has broad capabilities including file system access, git operations, GitHub repository/PR management via
gh, and arbitrary command execution inside Docker containers viascripts/run-tests.sh. - Sanitization: Python parsing scripts extract specific JSON fields but do not sanitize or escape natural language instructions within those fields.
- [COMMAND_EXECUTION]: The skill relies extensively on executing shell commands and local scripts to perform its tasks.
- The scripts
scripts/run-tests.shandscripts/build-integration.shexecute various commands (Docker, git, PHPUnit) to verify security fixes. This is the intended primary purpose of the skill and is performed on the user's local environment with their authorization.
Audit Metadata