codebase-to-demo
Fail
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to identify and execute startup commands (such as those found in package.json, Makefile, or pyproject.toml) from untrusted external codebases to capture screenshots with Playwright. This pattern allows for arbitrary code execution from user-provided third-party sources.
- [EXTERNAL_DOWNLOADS]: The agent is directed to use git clone to pull entire repositories from arbitrary GitHub URLs and performs network requests to well-known services like exchangerate.host to retrieve currency conversion rates.
- [COMMAND_EXECUTION]: The agent is tasked with executing various shell commands to clone external repositories and run local application scripts, which can be exploited if the source repository is malicious.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection.
- Ingestion points: The agent analyzes and processes files from external, untrusted repositories (SKILL.md).
- Boundary markers: There are no explicit markers or instructions provided to separate untrusted codebase data from system instructions.
- Capability inventory: The agent can execute shell commands, clone repositories, and write files to the system (SKILL.md).
- Sanitization: There is no evidence of sanitization or safety checks performed on the ingested code before analysis or execution.
Recommendations
- AI detected serious security threats
Audit Metadata