setup-wizard
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill modifies shell initialization scripts (~/.bashrc or ~/.zshrc) to insert a persistent wrapper function that manages environment variables and path settings for the agent session.
- [EXTERNAL_DOWNLOADS]: The setup process uses well-known package managers like apt and brew, and Python's pip, to download and install dependencies from public registries.
- [COMMAND_EXECUTION]: The skill features an automated update flow that executes pip install when changes are detected in plugin requirements files.
- [PROMPT_INJECTION]: The skill ingests data from external files (plugin.json and requirements.txt) to drive package installation and environment setup, creating an indirect prompt injection surface. Evidence chain: 1. Ingestion points: Reads external plugin configuration and requirement files from plugin directories. 2. Boundary markers: None identified. 3. Capability inventory: Executes shell commands for package management and modifies shell profile files. 4. Sanitization: No content validation is performed on requirements files before being passed to pip.
Audit Metadata