ax-grep-cli
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests using
npx --yes ax-grep@latest, which downloads and executes the latest version of the utility from the NPM registry at runtime. - [COMMAND_EXECUTION]: The instructions explicitly guide the agent to execute shell strings or JSON argument arrays (
agent.*Command,agent.*CommandArgs) returned by the tool's output to continue its tasks. - [REMOTE_CODE_EXECUTION]: The skill establishes a multi-step execution chain where remote, untrusted data from a web page is processed by the tool to produce executable commands. This creates a surface for remote code execution if the tool's output can be influenced by malicious web content.
- [PROMPT_INJECTION]: The skill describes an autonomous execution policy that relies on instructions found within external tool data.
- Ingestion points: Data enters the context via the
ax-greptool which fetches content from arbitrary URLs or HTML input. - Boundary markers: The instructions do not define delimiters or provide guidance to ignore potentially malicious embedded instructions in the processed data.
- Capability inventory: The skill provides the agent with the capability to run shell commands based on the tool's navigation logic.
- Sanitization: There is no mention of validation, escaping, or human-in-the-loop checkpoints for the commands generated from the external data.
Audit Metadata