qa
Warn
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes git commands to perform diffing and various shell commands for environment setup and application control.
- [DATA_EXFILTRATION]: It accesses sensitive file paths including .env files and user configuration directories (e.g., ~/.config/) to retrieve tokens and credentials required for authenticated testing of API and CLI interfaces.
- [REMOTE_CODE_EXECUTION]: The skill sources a shell script (preflight.sh) from a computed path determined at runtime via the SHIP_PLUGIN_ROOT environment variable.
- [EXTERNAL_DOWNLOADS]: The startup process involves installing application dependencies, which typically fetches and executes code from external package registries.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes untrusted data from git diffs, API responses, and web page content while maintaining significant system capabilities.
- Ingestion points: Reads git diffs, OpenAPI specifications, and browser-rendered content.
- Boundary markers: Lacks explicit delimiters or instructions to the agent to disregard commands embedded within the ingested data.
- Capability inventory: Utilizes Bash and agent-browser for execution and interaction.
- Sanitization: Does not implement validation or sanitization of the external data before processing.
Audit Metadata