Skills
skills/fellowship-dev/dogfooded-skills/cold-start-check/Gen Agent Trust Hub

cold-start-check

Fail

Audited by Gen Agent Trust Hub on Apr 26, 2026

Risk Level: HIGHCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The Bash script uses the eval command to process data parsed from docs/cold-start-rubric.yml. Because the output of the YAML parser is not sanitized before being passed to eval, an attacker can include shell metacharacters in the rubric prompts or concepts to execute arbitrary commands.
  • [COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands for the claude CLI using input strings from the rubric file, which allows untrusted repository content to influence system execution.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 26, 2026, 02:53 AM