self-modifying-code
Warn
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill authorizes the agent to modify application source code, including scripts and components. This enables the introduction of arbitrary logic into the application's runtime.
- [COMMAND_EXECUTION]: The instructions permit the agent to modify project configuration files such as package.json and tsconfig.json. This can be used to alter project dependencies and build processes.
- [PROMPT_INJECTION]: The skill encourages exposing application state through window.__appState and data-* attributes. This creates an indirect prompt injection surface where untrusted application data could influence agent behavior.
- Ingestion points: window.__appState and data-* attributes in components.
- Boundary markers: None mentioned for data processed from these state objects.
- Capability inventory: Modification of scripts, components, and package configuration (package.json).
- Sanitization: No instructions provided for sanitizing or validating application state before processing.
Audit Metadata