ops-status
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill employs the dynamic command execution syntax in SKILL.md to run shell commands at load time. It specifically interpolates the $ARGUMENTS variable into the command line
${CLAUDE_PLUGIN_ROOT}/bin/ops-status $ARGUMENTS. If the platform does not pre-sanitize user input, this allows for arbitrary command injection by providing malicious arguments. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection.
- Ingestion points: The verbatim output of the bin/ops-status script is injected into the agent's context during skill load.
- Boundary markers: There are no boundary markers or instructions to ignore embedded commands within the script's output.
- Capability inventory: The skill is configured with access to Bash, Read, and Glob tools.
- Sanitization: The skill does not perform any sanitization or validation of the script output before presenting it to the model.
- [COMMAND_EXECUTION]: The skill triggers the execution of a local binary using user-supplied arguments. While the binary is part of the skill package, the lack of argument validation represents a significant security risk in a shell-execution context.
Audit Metadata