style-authoring
Fail
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to install the 'citum' CLI by downloading a script from 'github.com/citum/citum-core' and piping it directly to the shell ('curl -fsSL ... | sh'). This pattern is used for software installation but allows for the execution of unverified remote code.\n- [EXTERNAL_DOWNLOADS]: The skill fetches external resources, including a JSON schema from 'docs.citum.org' and style templates or fixtures from GitHub. These resources are utilized to define validation rules and rendering behavior.\n- [COMMAND_EXECUTION]: The skill executes local command-line tools such as 'citum', 'cargo', and 'gh' to validate YAML files and render citation examples. These operations are performed on content that may be derived from external sources.\n- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8) because it processes external schemas and style files that could potentially influence the agent's logic or tool parameters.\n
- Ingestion points: Reads external files 'style.json' from 'docs.citum.org' and style definitions from 'github.com'.\n
- Boundary markers: No specific delimiters are used to isolate externally-fetched data from the agent's core instructions.\n
- Capability inventory: Employs subprocess execution ('citum', 'cargo') and network requests ('curl') which could be influenced by external data.\n
- Sanitization: There is no explicit validation or sanitization of external content before it is incorporated into the agent's context.
Recommendations
- HIGH: Downloads and executes remote code from: https://github.com/citum/citum-core/releases/latest/download/install.sh - DO NOT USE without thorough review
Audit Metadata