stelow-entry
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bash script block to perform environment setup, executing commands like
git rev-parseandcp. It relies on theSTELOW_STATEenvironment variable for file paths; if this variable is maliciously set, it could lead to arbitrary file writes within the local environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user input to generate a
state.mdfile that is subsequently used by other skills, creating a potential injection surface. - Ingestion points: User descriptions of project intent and scope in
SKILL.md. - Boundary markers: The generated
state.mdfile does not utilize specific delimiters to isolate user-derived content from instructions. - Capability inventory: The skill has permissions for shell command execution and local file system writes.
- Sanitization: There is no instruction to sanitize or escape user-derived project names before they are embedded into the YAML frontmatter of the state file.
Audit Metadata