warden
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for fetching and executing remote skills from arbitrary GitHub repositories using the warden add --remote and warden sync commands. This capability allows the execution of agent instructions from unverified third-party sources.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted data in the form of local source code, git diffs, and uncommitted changes. This creates a vulnerability surface where malicious instructions embedded in the analyzed code could influence agent behavior. The ingestion points include files passed to warden, glob patterns, and git references documented in SKILL.md and references/cli-reference.md. The skill lacks explicit boundary markers or sanitization, and has capabilities including bash execution for file reads and writes (via --fix).
- [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands through the warden CLI, including sub-commands like setup-app which initiates a local server and manifest flow for GitHub App creation.
Audit Metadata