podbenchmark
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands using the
npx podbenchmarkutility. - [EXTERNAL_DOWNLOADS]: The skill fetches the
podbenchmarkpackage from the npm registry at runtime usingnpx. - [DYNAMIC_EXECUTION]: The skill utilizes
npxto dynamically fetch and execute code, which can vary across executions. - [INDIRECT_PROMPT_INJECTION]: The skill processes external supplier links, which serves as an ingestion point for untrusted data.
- Ingestion points: Supplier and product URLs passed as arguments to the
comparecommand inSKILL.md. - Boundary markers: The instructions do not define delimiters or provide warnings to ignore potential instructions embedded in the external content.
- Capability inventory: Shell command execution via the
npxenvironment. - Sanitization: There is no description of logic to sanitize or validate the content retrieved from the external links.
Audit Metadata