c-lockin
Warn
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs dynamic script generation and execution.
- Evidence: The skill generates shell scripts using the
openpaw lockin gen-scriptscommand. - Evidence: It immediately executes these generated scripts using
bash /tmp/lockin-start.shandbash /tmp/lockin-end.sh. This pattern is vulnerable to command injection if the generator tool or its inputs are compromised. - [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection through its use of local configuration data.
- Ingestion points: The skill reads untrusted data from
~/.config/openpaw/lockin.jsonand~/.config/openpaw/lockin-session.json. - Boundary markers: No delimiters or safety instructions are used to separate configuration data from behavioral logic.
- Capability inventory: The agent has the capability to execute arbitrary shell commands and interact with the Obsidian CLI.
- Sanitization: There is no evidence of sanitization or validation of the configuration data before it is used to influence agent behavior or script generation.
Audit Metadata