resume
Fail
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions directly interpolate the
$ARGUMENTSvariable into shell commands, such asuv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief $ARGUMENTS. This allows an attacker to execute arbitrary shell commands by providing input containing shell metacharacters like;,&, or|.- [PROMPT_INJECTION]: The skill processes untrusted data from reconnaissance files and agent memory, creating a surface for indirect prompt injection. - Ingestion points: Data is read from the
recon/directory and.claude/agent-memory-local/chain-pending.md. - Boundary markers: None; untrusted content is not delimited from system instructions.
- Capability inventory: Execution of Python scripts via
uv runand file access viacat. - Sanitization: No validation or sanitization is performed on the data ingested from the reconnaissance files.
Recommendations
- AI detected serious security threats
Audit Metadata