logic-review
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill implements an 'Execution Verification Gate' in logic-review-guide.md (Step 8) which generates reproducer scripts and executes them using system runtimes such as python3, node, or go. This involves runtime assembly and execution of code.
- [REMOTE_CODE_EXECUTION]: By executing reproducer scripts derived from user-supplied code snippets, the skill risks executing malicious payloads if the input code is crafted to exploit the execution environment during the verification phase.
- [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: The skill ingests untrusted code from users for logic analysis (Step 1). 2. Boundary markers: There are no explicit delimiters or sanitization routines defined for the input code before it is used to generate execution scripts. 3. Capability inventory: The skill utilizes subprocess calls to system runtimes to run generated scripts. 4. Sanitization: The skill relies on natural language instructions to the AI agent to ensure generated scripts contain 'only pure computation', which lacks technical enforcement and could be bypassed by adversarial inputs.
- [COMMAND_EXECUTION]: The skill instructs the agent to invoke shell commands like
python3 --version,node --version, andgo versionto detect available runtimes on the host system.
Audit Metadata