codeguard-shell
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process the contents of shell scripts and the resulting output from linting tools.\n
- Ingestion points: The agent reads local
.sh,.bash, and.zshfiles as part of the workflow defined in SKILL.md.\n - Boundary markers: There are no explicit instructions or delimiters provided to ensure the agent ignores potential instructions embedded within script comments or tool error messages.\n
- Capability inventory: The agent has the capability to execute shell commands (shellcheck, shfmt), read files, and write modifications to the local filesystem.\n
- Sanitization: The skill does not define a process for sanitizing script content or tool output before it is processed by the AI model.\n- [COMMAND_EXECUTION]: The skill instructs the agent to dynamically build and run shell commands based on file paths.\n
- Evidence: The skill body and examples describe executing commands like
shellcheck '{file}'and complexfind | xargspipelines.\n - Risk: If the
{file}placeholder is replaced with a maliciously crafted filename containing shell metacharacters (e.g., backticks or semicolons), it could lead to arbitrary command execution within the agent's environment.\n- [EXTERNAL_DOWNLOADS]: The skill references the installation of third-party linting and formatting tools from external sources.\n - Evidence: The SKILL.md and references/tooling/toolchain.md files suggest the use of
brew install shellcheck shfmt.\n - Note: The installation is performed via the Homebrew package manager.
Audit Metadata