batch-file-ops
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes filenames from the local filesystem, which constitutes a potential attack surface for indirect prompt injection. \n
- Ingestion points: Filenames are read in
batch_file_ops.pyvia thelist_filesfunction usingpathlib.globandpathlib.rglob. \n - Boundary markers: The skill does not implement boundary markers to isolate processed filenames from the agent's instructions. \n
- Capability inventory: The tool has significant capabilities, including file deletion (
f.unlink), movement (shutil.move), and copying (shutil.copy2) withinbatch_file_ops.py. \n - Sanitization: The script does not perform sanitization or validation of filenames before they are presented to the agent or used in filesystem operations. \n- [SAFE]: The skill provenance points to a recognized vendor repository (
github.com/ellmos-ai/bach). The code is transparent, uses zero external dependencies, and follows best practices for file operations.
Audit Metadata