run
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The instructions direct the agent to search for
.claude/skills/*/SKILL.mdfiles in the current and parent directories and explicitly command the agent to "follow it verbatim" without paraphrasing. This creates a vulnerability surface where a malicious actor could place a craftedSKILL.mdfile in a repository that, when processed by the agent, triggers unauthorized actions. - Ingestion points: Local filesystem search for
SKILL.mdfiles (SKILL.md). - Boundary markers: None; the agent is instructed to follow the content verbatim.
- Capability inventory: Shell command execution, server management, and GUI/TUI interaction capabilities.
- Sanitization: None; the skill lacks validation for the content of discovered skill files.
- [COMMAND_EXECUTION]: The skill includes a bash script intended for execution by the agent to traverse the directory structure and locate specific configuration files. While the script itself is a discovery tool, it facilitates the ingestion of potentially untrusted local data.
Audit Metadata