Skills
Navigate
skills/cartoonitunes/inlay-skills/ai-readiness-audit/Gen Agent Trust Hub

ai-readiness-audit

Fail

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/audit.sh is vulnerable to shell command injection. It takes user-supplied input (the URL) and interpolates it directly into a double-quoted string within a curl command. An attacker could use shell metacharacters like semicolons or command substitution to execute arbitrary commands on the host system.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted data from the user and an external API without sanitization.
  • Ingestion points: The URL argument in scripts/audit.sh and the JSON response from inlay.dev.
  • Boundary markers: Absent. The skill does not use delimiters to isolate external data from its instructions.
  • Capability inventory: The skill executes shell commands, runs Python code, and suggests modifying local project files such as llms.txt, robots.txt, and HTML metadata.
  • Sanitization: None. User input is passed directly to the shell, and API output is parsed and displayed without validation.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 7, 2026, 02:29 PM