why-change
Warn
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local initialization scripts via the Bash tool using user-supplied parameters without sanitization. In Step 0.8, the customer_name, segment_name, and language variables are directly interpolated into a shell command template. A malicious user could provide a string containing shell metacharacters (such as backticks, semicolons, or pipe symbols) to achieve arbitrary command execution within the agent's environment.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its reliance on web research to inform deliverables. \n- Ingestion points: Untrusted external content is ingested via the WebSearch and WebFetch tools during the research phases (1-4). \n- Boundary markers: Absent. The instructions and sub-agent prompts do not define specific delimiters or security guardrails to ensure that instructions embedded within fetched web pages do not override the agent's intended behavior. \n- Capability inventory: Bash, Write, Edit, Agent, WebSearch, WebFetch. \n- Sanitization: None detected.
Audit Metadata