delete-render-profile
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands (
jq,mv,cat,test) to manage a local JSON file in a designated application data directory. - [PROMPT_INJECTION]: The skill processes and displays contents from
render-profiles.json, which presents an indirect prompt injection surface. - Ingestion points: Reads from
render-profiles.jsoninSKILL.md. - Boundary markers: No specific delimiters or instructions provided to the agent to distinguish between data and potential commands within the file.
- Capability inventory: Access to
Bash(test, jq, mv, cat),Read, andWritetools across the script. - Sanitization: The skill uses the
jq --argflag to safely interpolate the profile name, preventing shell injection into thejqcommand logic.
Audit Metadata