cve-triage
Fail
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes dynamic context injection to execute shell commands during the initialization phase to display the current version of the CISA KEV catalog. \n- [EXTERNAL_DOWNLOADS]: Fetches data from the official CISA website during skill load to provide versioning information. Evidence: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json. \n- [REMOTE_CODE_EXECUTION]: Metadata is extracted by piping the output of a network request directly into a Python one-liner interpreter. Evidence: Found in SKILL.md as
curl -sf ... | python3 -c. \n- [PROMPT_INJECTION]: The skill is designed to process untrusted vulnerability scan results, which creates a surface for indirect prompt injection. \n - Ingestion points: The skill parses results from vulnerability scanners like Qualys, Tenable, and Snyk (SKILL.md). \n
- Boundary markers: No explicit delimiters are defined for isolating external data, though the skill includes a safety notice for the agent. \n
- Capability inventory: The skill utilizes tools such as Read, Grep, Glob, and WebFetch (SKILL.md). \n
- Sanitization: Employs a 'Prompt Injection Safety Notice' that instructs the agent to ignore instructions embedded in the external scan output.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - DO NOT USE without thorough review
Audit Metadata