calicat-cli-operator
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for the agent to install the Calicat CLI by downloading and executing shell scripts directly from the vendor's domain (https://www.calicat.cn/cli/install.sh and https://www.calicat.cn/cli/install.ps1) using piped execution (| bash and | iex).
- [COMMAND_EXECUTION]: The skill instructs the agent to use powershell -ExecutionPolicy Bypass to execute the vendor's installation script, which bypasses local security policies.
- [COMMAND_EXECUTION]: The skill involves various shell command executions to interact with the local filesystem (e.g., rm, redirecting output to scratch/) and perform network operations.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of external design data. 1. Ingestion points: The agent fetches design payloads via the get_design_data command in SKILL.md. 2. Boundary markers: There are no instructions for using delimiters or boundary markers to isolate untrusted data from the agent's instructions. 3. Capability inventory: The skill provides access to shell execution (calicat), network operations (curl), and the ability to create and execute local helper scripts (python, node). 4. Sanitization: The skill does not define any procedures for sanitizing or validating the retrieved JSON design data before processing.
Audit Metadata