understand-chat
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (grep) using user-supplied input from the $ARGUMENTS variable without sanitization. Evidence: Instruction 3: 'use Grep to search the knowledge graph file for the user's query keywords: "$ARGUMENTS"'. Risk: Maliciously crafted user input could potentially break out of the command string to execute unauthorized shell commands.
- [PROMPT_INJECTION]: The skill processes untrusted data from a codebase-derived knowledge graph file, making it vulnerable to indirect prompt injection. Ingestion points: .ua/knowledge-graph.json or .understand-anything/knowledge-graph.json (SKILL.md). Boundary markers: Absent; no delimiters are used to wrap external content. Capability inventory: File reading and shell command execution. Sanitization: Absent; the agent is not instructed to filter or ignore instructions found within the data.
Audit Metadata