plan-report
Warn
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to verify implementation by executing arbitrary local scripts found in the analyzed project, specifically 'available tests, type checks, validation scripts, builds, or smoke tests' (found in SKILL.md under Workflow Step 3). This poses a risk of local code execution if the verification suite within the project environment is malicious or compromised.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is designed to ingest and process a wide variety of untrusted external artifacts (source code, documentation, logs, git metadata) and perform actions based on their content.
- Ingestion points: The agent is directed to read source code, configuration files, documentation, and logs from the target project (SKILL.md).
- Boundary markers: The instructions lack explicit boundary markers or directions to isolate the agent's logic from instructions that may be embedded in the audited artifacts.
- Capability inventory: The agent has the capability to read local files and execute shell commands to verify completion.
- Sanitization: No sanitization or validation is performed on the scripts or commands identified in the project prior to their execution.
Audit Metadata