ccg
Warn
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates shell commands by interpolating AI-constructed prompts directly into bash strings (e.g.,
omc ask codex "<codex prompt>"). This pattern is vulnerable to command injection if the generated text contains shell metacharacters like backticks or semicolons.- [EXTERNAL_DOWNLOADS]: The instructions recommend installing@openai/codexand@google/gemini-clivia NPM. These are not the official package names used by OpenAI or Google, creating a supply chain risk where untrusted code might be installed.- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external model outputs during synthesis. - Ingestion points: Files located in
.omc/artifacts/ask/(SKILL.md). - Boundary markers: No delimiters or instructions are used to isolate untrusted tool outputs.
- Capability inventory: The skill uses the bash tool to execute CLI commands (SKILL.md).
- Sanitization: The skill does not sanitize or escape the content of the external files before synthesizing them into the final response.
Audit Metadata