call-external-ai
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to invoke external CLI binaries (
codex,claude,gemini,agy,pi) via shell commands executing user input. Interpolating user prompts directly into command arguments ("<prompt text>") creates a risk of command or argument injection if the user input contains unescaped quotes or if the execution environment runs the command within a shell context. - [INDIRECT_PROMPT_INJECTION]: The skill accepts arbitrary natural language requests from users and passes them to external tools, exposing a potential indirect prompt injection vulnerability surface.
- Ingestion points: Untrusted user input enters the agent context through the natural language interaction interface defined in
SKILL.md(e.g.,/call,/codex,/claude). - Boundary markers: Partially present; prompts are encapsulated within double quotes in command templates, but there are no instructions for the target models to isolate or ignore adversarial instructions embedded in the user text.
- Capability inventory: The skill possesses sub-process execution capabilities to run command-line interfaces (
codex,claude,gemini,agy,pi) as detailed inSKILL.mdandreference/cli-reference.md. - Sanitization: Absent at the input level; the skill relies entirely on negative instructions to the agent (e.g., forbidding shell substitution, backticks, or operator chaining) rather than automated programmatic sanitization or robust argument escaping.
Audit Metadata