ai-script
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local script located at a specific hardcoded path (
/Volumes/SSD2T/code/ai-script/ai-script). This grants the agent the ability to run various subcommands which interact with the local filesystem and external APIs via the shell.\n- [DATA_EXFILTRATION]: The tool's wrapper script sources the user's~/.zshrcfile to load environment variables. This action imports the entire user environment—potentially including sensitive credentials, private tokens, and system configuration unrelated to the skill—into the process environment where it could be accessed by the tool.\n- [PROMPT_INJECTION]: The skill enables an indirect prompt injection surface by retrieving untrusted data from external sources and piping it directly into an LLM.\n - Ingestion points: Data retrieved from the web via the
search,scholar, andscrapesubcommands described inSKILL.md.\n - Boundary markers: The provided usage examples (e.g.,
./ai-script search ... | ./ai-script llm ...) do not include delimiters or instructions to the LLM to ignore potentially malicious commands embedded in the retrieved content.\n - Capability inventory: The tool has the capability to execute shell commands, perform network operations to various AI providers, and write output to the local filesystem.\n
- Sanitization: No sanitization, escaping, or filtering of the retrieved web content is mentioned or implemented in the instruction flow.
Audit Metadata