fullscan
Fail
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: HIGHCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform multiple shell operations using the
uv run python3command pattern. - [COMMAND_EXECUTION]: User-provided
$ARGUMENTSare directly interpolated into shell commands in 'Phase 0' and 'Phase 4' (e.g.,uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief $ARGUMENTS). This structure is highly susceptible to shell command injection if a user provides input containing metacharacters such as semicolons, pipes, or backticks. - [COMMAND_EXECUTION]: The workflow relies on executing Python scripts located in
$CLAUDE_PROJECT_DIR/tools/(such asbrain.py,scope_check.py, anddedup_findings.py) which are not included within the skill package, creating an external dependency on the local environment.
Recommendations
- AI detected serious security threats
Audit Metadata