ablate-ai-layer

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/run_ablation.py script uses the subprocess.run module to interact with Git (for creating and removing worktrees) and to execute AI agent CLI tools such as Claude Code.
  • [COMMAND_EXECUTION]: The skill provides a --runner flag in scripts/run_ablation.py which allows the agent or user to specify an arbitrary shell command to run a non-Claude agent. This command is executed using subprocess.run with shell=True.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the target repository's files and a user-provided task file. This content is interpolated into agent sessions without specific sanitization or boundary markers. However, this is inherent to the skill's purpose of testing how an agent reacts to repository context, and the risk is contained within the local development environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 04:27 PM
Security Audit — agent-trust-hub — ablate-ai-layer