stelow-product-shape-up
Warn
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The file
references/cli-tools/cymbal.mdcontains installation instructions that use a potentially dangerous pattern where a remote script is piped directly into an execution engine (irm https://raw.githubusercontent.com/1broseidon/cymbal/main/install.ps1 | iex). The source repository1broseidon/cymbalis not on the trusted vendors list. - [COMMAND_EXECUTION]: The skill uses
sourceto dynamically load and execute a shell script from a computed path (../../stelow-product-orchestrator/references/cli-tools/read-config.sh). This creates a dependency on external files that are executed within the current shell context. - [COMMAND_EXECUTION]: The skill executes arbitrary shell commands to perform technical analysis, including
find,grep, andnode -eto parse local project files. While these are for legitimate functionality, they provide a broad surface for command execution based on local file content. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files (e.g.,
package.json,go.mod,stelow.json) and incorporates this information into the product shaping process. There are no explicit boundary markers or sanitization steps mentioned to prevent embedded instructions in these files from influencing the agent's behavior. - Ingestion points: Reads project manifest files (
package.json,go.mod, etc.) and workflow configurations (stelow.json). - Boundary markers: Absent in the provided scripts.
- Capability inventory: Uses subprocess calls for shell commands (
find,grep,wc),nodefor JSON parsing, andsourcefor script execution. - Sanitization: No evidence of input validation or escaping for the data read from project files.
Audit Metadata