cs-feat-ff
Warn
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs and executes shell commands using variables ('keywords', 'slug') derived from user input without explicit sanitization. If these strings contain shell metacharacters, an attacker could achieve arbitrary command execution.\n
- Evidence:
grep -r "关键词" .codestable/compound/\n - Evidence:
python3 .codestable/tools/codestable-worktree-gate.py ... --unit .codestable/features/YYYY-MM-DD-{slug}\n- [REMOTE_CODE_EXECUTION]: The skill executes a local Python script within the project repository. While the tool is project-specific, executing scripts from the filesystem is a sensitive operation.\n - Evidence:
python3 .codestable/tools/codestable-worktree-gate.py\n- [PROMPT_INJECTION]: The skill reads external project data that could contain malicious instructions (Indirect Prompt Injection).\n - Ingestion points: Reads from
.codestable/requirements/CONTEXT.mdand.codestable/requirements/adrs/.\n - Boundary markers: Absent. No isolation of processed data.\n
- Capability inventory: Shell execution and file system writes.\n
- Sanitization: None. Ingested data is used directly to influence agent logic.
Audit Metadata