capture-eval-issues
Fail
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions in
judge-prompt.mddirect the subagent to execute a shell command using string interpolation:echo '<yaml_array>' | bun run .... Because theyaml_arraycontent is derived from external JSON files and source code snippets, an attacker can include a single quote to terminate the string and append malicious shell commands (e.g.,'; rm -rf /; '). This leads to arbitrary code execution in the agent's environment. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests untrusted data from review JSON files and source code files. Malicious instructions embedded in these files (e.g., in an 'issue' description or a code comment) could manipulate the subagent's decision-making process or cause it to bypass its intended logic.
- Ingestion points:
judge-prompt.md(processes user-specified JSON files and source code files). - Boundary markers: Absent. Data is interpolated directly into the subagent's context without delimiters or warnings.
- Capability inventory:
Read(file system access),Bash(shell execution),Task(subagent spawning). - Sanitization: Absent. The instructions do not specify any escaping or validation for the data before it is used in shell commands.
Recommendations
- AI detected serious security threats
Audit Metadata