c-ai
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
aichat -ecommand enables the generation and direct execution of shell commands from natural language, creating a risk of unintended system actions. - [EXTERNAL_DOWNLOADS]: The
llm installfunctionality allows for downloading and installing third-party plugins, which involves executing code from external repositories. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by piping untrusted data from files, git diffs, and the clipboard into LLM prompts without using delimiters or sanitization.
- Ingestion points: SKILL.md contains multiple examples of piping external data (article.txt, git diff, pbpaste) into LLM prompts.
- Boundary markers: No delimiters or protective instructions are used to separate ingested data from task instructions.
- Capability inventory: High-risk capabilities include shell command execution via
aichat -eand plugin installation viallm install. - Sanitization: No input validation, escaping, or filtering of piped content is implemented.
Audit Metadata