ss-component
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command (
node "<ss-resolve>/scripts/resolve-context.mjs" ...) where the<artifact-id>and<agent>parameters are derived from user-supplied arguments ($0,$ARGUMENTS). This setup poses a command injection risk if the agent does not properly sanitize these inputs before constructing the command string. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data to inform its code generation tasks, creating a surface for indirect prompt injection attacks.
- Ingestion points: The agent is instructed to read various local project files, including
.styleseed/project.json,.styleseed/artifacts/index.json,.styleseed/bundles/<artifact-id>.md,.styleseed/manifests/<artifact-id>.json, and existing source files. - Boundary markers: None identified in the instructions.
- Capability inventory: The skill uses
Read,Write,Edit, andBashtools. - Sanitization: There are no instructions provided to sanitize or validate the content of the ingested files before using them to generate new code.
Audit Metadata