coding-agent
Warn
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the bash tool to execute complex shell commands with pseudo-terminal (PTY) allocation and background execution capabilities. It also documents an 'elevated' parameter that allows commands to run on the host system rather than in a sandbox environment.
- [REMOTE_CODE_EXECUTION]: A core feature of the skill is spawning sub-agents designed to execute code. The instructions explicitly direct the agent to use flags like '--yolo' and '--permission-mode bypassPermissions', which disable critical safety controls, sandboxing, and manual approval steps for file modifications.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its integration with external, untrusted data sources.
- Ingestion points: Processes repo files, git diffs, and Pull Request content within the specified working directories.
- Boundary markers: Absent. There are no delimiters or instructions provided to separate user commands from data ingested from files or remote repositories.
- Capability inventory: Provides shell access with PTY, background tasking, file system modification, and network access through CLI tools like 'gh' and 'git'.
- Sanitization: Absent. Untrusted content from repositories or PRs is interpolated directly into prompts and commands executed by the spawned agents.
- [COMMAND_EXECUTION]: Recommends the global installation of an external NPM package (@mariozechner/pi-coding-agent) to extend the agent's functionality.
Audit Metadata