jules-cli

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the jules CLI to manage remote development environments, including creating new sessions, listing repositories, and pulling code changes. This is the primary function of the skill.\n- [PROMPT_INJECTION]: The skill integrates results from remote coding tasks into the local filesystem, which presents a surface for indirect prompt injection if the remote environment contains malicious instructions.\n
  • Ingestion points: Remote session data and code changes retrieved via jules remote pull commands in SKILL.md and references/usage.md.\n
  • Boundary markers: The skill includes usage guidelines and safety controls (e.g., 'Approval Required' and 'Complexity Threshold') to mitigate risks, though no explicit technical delimitation of fetched content is present.\n
  • Capability inventory: The skill can create remote tasks (jules remote new) and modify the local filesystem (jules remote pull --apply).\n
  • Sanitization: No explicit validation or filtering of the code content retrieved from the remote sessions is performed before application to the local repository.\n- [COMMAND_EXECUTION]: A Python script is executed as a one-liner to parse and extract status information from the tabular output of the jules CLI.\n
  • Evidence: python3 -c "import sys, re; [print(re.split(r'\s{2,}', l.strip())[-1]) for l in sys.stdin if l.startswith('<SESSION_ID>')] " found in SKILL.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 12:23 AM
Security Audit — agent-trust-hub — jules-cli