ingredient-research
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a shell-based preamble that executes to manage environment state. This preamble runs commands to check for updates (rmbc-update-check), log analytics (rmbc-analytics), and modify local configuration files using sed. It also uses the open command to launch an external YouTube URL in the browser.- [COMMAND_EXECUTION]: A significant command injection vulnerability is present in the workspace activation step. The skill instructs the agent to execute /bin/rmbc-workspace active "<user's answer>" using freeform text input retrieved from the user. Without proper sanitization, this allows for the execution of arbitrary shell commands if the user provides input containing metacharacters like ; or &&.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it utilizes WebSearch and WebFetch to ingest untrusted data from clinical studies and marketing websites.
- Ingestion points: Research loop involving WebSearch and WebFetch tools in Step 2.
- Boundary markers: Absent. The instructions do not provide delimiters or clear guidance to the agent to disregard instructions found within the fetched data.
- Capability inventory: The skill possesses shell execution capabilities and filesystem access, which could be leveraged by a successful injection attack.
- Sanitization: Absent. External content is not sanitized or escaped before being processed into the output brief.- [EXTERNAL_DOWNLOADS]: The skill references an external YouTube video and contains logic for an update check that directs users to an inline upgrade flow, which may involve downloading and executing new skill components.
Audit Metadata