effect-command-executor
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary purpose is to provide instructions and examples for spawning and managing child processes using the
ChildProcessmodule from the Effect framework. It details methods for capturing output, piping commands, and managing process lifecycles using theChildProcessSpawnerservice.\n- [PROMPT_INJECTION]: The skill describes an attack surface for indirect prompt injection where untrusted data could be interpolated into shell commands. \n - Ingestion points: Variables like
${name}or${files}inChildProcess.maketemplates inreferences/03-creating-commands.md.\n - Boundary markers: The documentation notes that the template literal form parses expressions as separate arguments, which is a security-oriented feature of the library designed to prevent shell injection.\n
- Capability inventory: Extensive child process execution capabilities including
spawn,string, andpipeToas detailed across the reference files (e.g.,references/04-executing-commands.md).\n - Sanitization: The provided patterns rely on the library's internal argument handling rather than demonstrating manual validation or sanitization of external input.
Audit Metadata