proposal-check
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions explicitly direct the agent to execute shell commands (
chmod a-worattrib +R) using user-provided filenames to enforce read-only access. This pattern is susceptible to command injection if the filenames contain shell metacharacters designed to execute additional arbitrary code.\n- [COMMAND_EXECUTION]: The skill requires the agent to run a local script (scripts/check.py) via the shell, passing a user-supplied filename as an argument.\n- [PROMPT_INJECTION]: The skill processes untrusted user data from the proposal file and the workspace configuration file, creating a surface for indirect prompt injection.\n - Ingestion points: The skill reads the contents of
proposal.mdandguidelines.md(specifically the TOML block).\n - Boundary markers: There are no explicit delimiters or instructions to isolate or ignore embedded commands within the ingested data.\n
- Capability inventory: The skill utilizes shell execution and file reading capabilities.\n
- Sanitization: No sanitization is performed on user-supplied file paths or ingested content before use in shell commands or script execution.
Audit Metadata