crewai-multi-agent
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The 'CalculatorTool' example in 'SKILL.md' utilizes the Python 'eval()' function to process expression inputs.\n
- Evidence: 'result = eval(expression)' in the '_run' method.\n
- Risk: Arbitrary code execution is possible if the input is not validated, posing a significant risk if the agent processes malicious instructions as calculation inputs.\n- [INDIRECT_PROMPT_INJECTION]: The skill integrates tools for retrieving external data, creating an attack surface where untrusted content could influence agent behavior.\n
- Ingestion points: Tools such as 'SerperDevTool' and 'ScrapeWebsiteTool' fetch data from external URLs as documented in 'references/tools.md'.\n
- Boundary markers: No clear delimiters or instructions are used to separate untrusted tool outputs from the agent's core instructions.\n
- Capability inventory: The skill environment provides agents with access to high-privilege capabilities including file manipulation ('FileWriterTool') and a Python code execution environment ('CodeInterpreterTool').\n
- Sanitization: There is no logic shown for filtering or sanitizing external content before it is processed by the agents.\n- [COMMAND_EXECUTION]: The use of 'eval()' facilitates the execution of arbitrary Python code, which can be used to execute system commands or access unauthorized resources.
Audit Metadata