store-query-nlp
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Node.js script path that is dynamically resolved from a local configuration file (
./.forge/config.json) usingnode -e. This creates a dependency on the integrity of the local filesystem and configuration. - [COMMAND_EXECUTION]: The skill constructs and executes a shell command that includes user-supplied natural language as an argument:
node "$FORGE_ROOT/tools/store-cli.cjs" nlp "<natural language query>". This presents a potential command injection surface if the input is not strictly sanitized or if the agent does not correctly escape shell metacharacters within the query. - [DATA_EXPOSURE]: The skill is designed to read and return information from a local storage system (bugs, tasks, features). While this is the primary purpose of the skill, it involves accessing internal project metadata and file paths.
Audit Metadata