moos-ivp-repo-builder
Fail
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill clones a repository from a third-party GitHub URL and subsequently runs a build script from within that repository, creating a high-risk pattern for executing unverified external code. Evidence: The workflow includes 'git clone https://github.com/moos-ivp/moos-ivp-extend.git' followed by instructions to 'Run ./build.sh'.
- [PERSISTENCE]: The skill attempts to modify shell startup configuration files to ensure project environment variables are loaded automatically across user sessions. Evidence: The skill instructs the agent to 'update the selected shell profile' (e.g., '
/.zshrc' or '/.bashrc') with a block that sources a repository-local environment file. - [COMMAND_EXECUTION]: The skill utilizes several shell commands to manage files and git state on the user's system. Evidence: Instructions include the use of 'rm -rf .git', 'git init', and 'git commit'.
- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by ingesting and processing data from a third-party repository while possessing sensitive shell capabilities. 1. Ingestion points: Content from the 'moos-ivp-extend' template repository (README.md, CMakeLists.txt). 2. Boundary markers: No delimiters or explicit ignore instructions are identified for the processed template content. 3. Capability inventory: Shell command execution, file system modification, and shell profile editing. 4. Sanitization: No explicit validation or filtering of the template content is described before processing.
Recommendations
- AI detected serious security threats
Audit Metadata