host-workspace-operator
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from the host workspace, which constitutes untrusted external data that may contain malicious instructions.\n
- Ingestion points: The agent utilizes read, list, search, and grep operations to pull file content and directory structures into its context, as defined in SKILL.md.\n
- Boundary markers: The instructions suggest that the agent should "inspect repository instructions" and "respect existing scope," but there are no formal prompt delimiters or explicit warnings to ignore instructions found within files.\n
- Capability inventory: The skill authorizes the use of powerful mutation and execution tools, including write, patch, shell, and python (specifically sandbox-python-executor), which could be misused if the agent obeys instructions embedded in the workspace data.\n
- Sanitization: The skill lacks instructions for sanitizing or escaping content retrieved from the workspace before it is processed or passed to execution tools.\n- [COMMAND_EXECUTION]: The skill enables the agent to run commands within the host workspace shell.\n
- Evidence: The "Shell rules" section in SKILL.md provides guidelines for executing commands for testing, git inspection, and repository-native validation.\n- [DYNAMIC_EXECUTION]: The skill allows for the execution of Python code to perform deterministic parsing and data transformations.\n
- Evidence: The "Python handoff" section in SKILL.md describes the use of host-native Python via the sandbox-python-executor tool.
Audit Metadata