agkan-run-direct
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from task titles and bodies which are then used to instruct a sub-agent to perform code changes.
- Ingestion points: Task data is fetched from the
agkanCLI in Step 2 (agkan task list) and Step 6 (agkan task get). - Boundary markers: Data is placed under markdown headers (
## Task Information) in the sub-agent prompt, but there are no explicit instructions to ignore potentially malicious commands embedded within the task text. - Capability inventory: The sub-agent has broad capabilities including local file system modification,
gitoperations (commit and push), and task management via theagkanCLI. - Sanitization: Task bodies are interpolated directly into shell command templates during error handling (Step 6) without evidence of escaping, which could lead to command injection if the task body contains shell metacharacters.
- [COMMAND_EXECUTION]: The skill uses local CLI tools to manage the development workflow and task lifecycle.
- Evidence: The workflow executes
agkan,git,gh(GitHub CLI), andjqfor configuration management, repository state updates, and task status tracking.
Audit Metadata