config
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process data from untrusted sources within a repository, creating a surface for indirect prompt injection attacks.\n
- Ingestion points: The agent reads project documentation (README.md, docs/.md), manifests (package.json, Cargo.toml), and CI workflow files (.github/workflows/.yml) to gather context.\n
- Boundary markers: No explicit delimiters or instructions are provided to the agent to treat external content as data only or to ignore embedded instructions.\n
- Capability inventory: The skill utilizes shell execution capabilities, including commands for directory traversal (find), repository inspection (git), and project-specific tooling (wt, cargo).\n
- Sanitization: The skill lacks mechanisms to sanitize or validate content extracted from external documents before it influences agent reasoning.\n- [COMMAND_EXECUTION]: The skill performs several shell operations to diagnose the project state and validate recommendations.\n
- Evidence: SKILL.md contains instructions to execute shell commands including git rev-parse, find, wt config show, wt doctor, rg, and cargo run/test.\n
- Local Script Execution: The agent is instructed to execute an external local script at ~/dotfiles/install.sh when working within the 'wt' repository context.
Audit Metadata