filesystem-context

Warn

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The TerminalCapture class in references/implementation-patterns.md uses subprocess.run with shell=True. This implementation is vulnerable to command injection if the input command contains data from untrusted or external sources.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides mechanisms to load external data into the agent's reasoning context, presenting a risk of indirect prompt injection.
  • Ingestion points: Data is read from files and terminal logs using functions like read_file, grep_terminals, and read_peer_findings.
  • Boundary markers: The implementation utilizes basic headers and structured data formats but lacks explicit instructions to the agent to ignore embedded commands.
  • Capability inventory: The skill includes tools for filesystem modification and shell execution.
  • Sanitization: While basic resource limits are present in the PreferenceStore, there is no content-based sanitization to prevent prompt or command injection.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 30, 2026, 09:38 AM
Security Audit — agent-trust-hub — filesystem-context