lore
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides installation commands in
references/setup.mdthat download and pipe scripts directly to a shell for execution (curl ... | bashandirm ... | iex). These resources are hosted on the official GitHub repository for Epic Games (https://raw.githubusercontent.com/EpicGames/lore/main/scripts/install.sh). - [INDIRECT_PROMPT_INJECTION]: The skill documents functionality for interacting with external repositories, which presents a surface for indirect prompt injection.
- Ingestion points: Commands like
lore clone,lore sync, andlore branch merge(described inreferences/cli.mdandreferences/workflow.md) read content and metadata from remote repository partitions. - Boundary markers: The instructions do not define specific delimiters or warnings to prevent the agent from following instructions embedded in the repository data.
- Capability inventory: The skill provides access to file system writes, network requests, and authentication token management.
- Sanitization: There are no documented procedures for sanitizing external content before it is processed by the agent.
Audit Metadata