jules-cli
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
julesCLI to manage remote development environments, including creating new sessions, listing repositories, and pulling code changes. This is the primary function of the skill.\n- [PROMPT_INJECTION]: The skill integrates results from remote coding tasks into the local filesystem, which presents a surface for indirect prompt injection if the remote environment contains malicious instructions.\n - Ingestion points: Remote session data and code changes retrieved via
jules remote pullcommands inSKILL.mdandreferences/usage.md.\n - Boundary markers: The skill includes usage guidelines and safety controls (e.g., 'Approval Required' and 'Complexity Threshold') to mitigate risks, though no explicit technical delimitation of fetched content is present.\n
- Capability inventory: The skill can create remote tasks (
jules remote new) and modify the local filesystem (jules remote pull --apply).\n - Sanitization: No explicit validation or filtering of the code content retrieved from the remote sessions is performed before application to the local repository.\n- [COMMAND_EXECUTION]: A Python script is executed as a one-liner to parse and extract status information from the tabular output of the
julesCLI.\n - Evidence:
python3 -c "import sys, re; [print(re.split(r'\s{2,}', l.strip())[-1]) for l in sys.stdin if l.startswith('<SESSION_ID>')] "found inSKILL.md.
Audit Metadata