recipe-modularization-audit-plan-marshall-skills
Warn
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill obtains a
{target_root}path via theAskUserQuestiontool and then directly interpolates it into a shell command:python3 .plan/execute-script.py ... --value {target_root}. A user or an automated process providing a path containing shell metacharacters (e.g.,;,&, or backticks) could achieve arbitrary command execution. - [PROMPT_INJECTION]: The skill is designed to recursively read and analyze a corpus of markdown files, which constitutes a surface for indirect prompt injection.
- Ingestion points: All
SKILL.mdand markdown files within the user-specified{target_root}directory are read into the agent's context. - Boundary markers: The instructions lack delimiters or explicit warnings to the agent to disregard instructions potentially embedded within the audited markdown files.
- Capability inventory: The skill possesses the
Bashtool and executes project-specific management scripts, providing a pathway for malicious instructions to influence the system. - Sanitization: There is no evidence of sanitization or validation of the content retrieved from the target skill corpus before it is processed by the agent.
Audit Metadata