show-me
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, specifically
Bash(open path/to/show-me-{description}.html), to display generated HTML artifacts. This is a standard pattern for skills providing rich visual feedback. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for processing untrusted data by incorporating conversation topics into generated visual artifacts.
- Ingestion points: The 'current topic of conversation' is used as the basis for all generated visuals (SKILL.md).
- Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are provided for the input data.
- Capability inventory: The skill allows the agent to generate code snippets, Mermaid diagrams, and HTML files, and subsequently execute shell commands to open these files.
- Sanitization: There are no explicit instructions for sanitizing or escaping the conversation content before it is interpolated into the diagrams or the filename for the HTML artifact.
Audit Metadata