quickscan
Warn
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uv run python3to execute multiple local scripts within the project directory. It passes$ARGUMENTSdirectly to the shell, which can be exploited for arbitrary command execution. - Evidence:
uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief $ARGUMENTSinSKILL.md. - Evidence:
uv run python3 $CLAUDE_PROJECT_DIR/tools/scope_check.py $ARGUMENTSinSKILL.md. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data into sensitive command-line operations.
- Ingestion points: User-provided input via
$ARGUMENTSinSKILL.md. - Boundary markers: Absent. The input is not wrapped in quotes or delimiters to prevent shell metacharacter expansion.
- Capability inventory: Subprocess execution via
uv run, interaction withbrain.py(database/logging), and the ability to launch sub-agents (recon,config-auditor). - Sanitization: Absent. The instructions do not define any validation or escaping for the external content before it is used in a shell context.
Audit Metadata