record
Fail
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs shell commands in Phases 2, 4, and 6 by interpolating session-derived variables such as
<last-action>,<next-action>,<alias-key>, and<full-meaning>directly into double-quoted Bash strings. This pattern is vulnerable to command injection via shell subshell expansion (e.g.,$(...)or backticks) if the variables contain malicious sequences. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted session data and utilizing it in shell commands.
- Ingestion points: Session state data is gathered from tool history, project files, and user dialogue in Phase 1 and 6.
- Boundary markers: No delimiters or instructions to ignore embedded commands are present during variable interpolation.
- Capability inventory: The skill uses the Bash tool to execute logic via the
memplan-cli.jsscript and thermcommand. - Sanitization: No evidence of escaping or validation is present for the session-derived variables before they are passed to the shell.
Recommendations
- AI detected serious security threats
Audit Metadata