effect-command-executor

Pass

Audited by Gen Agent Trust Hub on May 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary purpose is to provide instructions and examples for spawning and managing child processes using the ChildProcess module from the Effect framework. It details methods for capturing output, piping commands, and managing process lifecycles using the ChildProcessSpawner service.\n- [PROMPT_INJECTION]: The skill describes an attack surface for indirect prompt injection where untrusted data could be interpolated into shell commands. \n
  • Ingestion points: Variables like ${name} or ${files} in ChildProcess.make templates in references/03-creating-commands.md.\n
  • Boundary markers: The documentation notes that the template literal form parses expressions as separate arguments, which is a security-oriented feature of the library designed to prevent shell injection.\n
  • Capability inventory: Extensive child process execution capabilities including spawn, string, and pipeTo as detailed across the reference files (e.g., references/04-executing-commands.md).\n
  • Sanitization: The provided patterns rely on the library's internal argument handling rather than demonstrating manual validation or sanitization of external input.
Audit Metadata
Risk Level
SAFE
Analyzed
May 16, 2026, 08:24 PM