add-community-extension
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external GitHub issues which are untrusted sources.
- Ingestion points: Step 1 extracts metadata such as extension names, descriptions, and author handles from a GitHub issue.
- Boundary markers: There are no explicit markers or instructions provided to the agent to distinguish issue content from its own instructions.
- Capability inventory: The skill involves executing shell commands (
git,python3) and writing to repository files. - Sanitization: While some fields like ID and version are validated, descriptive fields like
<Name>are used without sanitization. - [COMMAND_EXECUTION]: The skill instructions facilitate the execution of shell commands using un-sanitized external data.
- Evidence: Step 6 instructs the agent to run
git commit -m "Add <Name> extension...". If an attacker provides a name containing shell metacharacters (e.g.,"; touch /tmp/pwned; #), it could lead to command injection when the agent executes the commit.
Audit Metadata