wt
Warn
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The shell script uses the
$ARGUMENTSvariable directly within multiple commands, such asgit worktree add worktree/"$ARGUMENTS". While double quotes prevent word splitting, Bash still evaluates command substitutions (e.g.,$(...)) and backticks inside them. This allows an attacker to execute arbitrary shell commands by crafting a malicious branch name.\n- [PROMPT_INJECTION]: The skill ingests untrusted data through the$ARGUMENTSparameter and uses it in a sensitive execution context (shell) without validation.\n - Ingestion points:
$ARGUMENTSparameter used inSKILL.mdshell block.\n - Boundary markers: None present.\n
- Capability inventory: Execution of arbitrary Bash commands, file system access, and network-enabled Git operations.\n
- Sanitization: None; the raw argument is directly interpolated into the shell command string.
Audit Metadata