chain
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local script tools/brain.py via uv run python3 to manage vulnerability context. This involves passing arguments derived from the agent context or user input.
- [PROMPT_INJECTION]: Indirect prompt injection surface exists as the skill aggregates untrusted input (user arguments and target data) and external configuration files into a prompt for a secondary agent.
- Ingestion points: $ARGUMENTS variable, rules/chain-table.md, policy.md, and the output of the brain.py script.
- Boundary markers: The instructions do not define clear delimiters or instruction-override protections for the ingested data.
- Capability inventory: The agent has access to read local files and execute shell commands via uv.
- Sanitization: There is no evidence of input validation or sanitization before the data is passed to the sub-agent or used in shell commands.
Audit Metadata