eval-content
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill process involves executing local Python scripts using shell commands with unvalidated user input. Specifically, Step 3 directs the agent to run
scripts/eval-runner.py --text "{content}". If the{content}variable contains shell metacharacters such as backticks, semicolons, or command substitutions, an attacker could achieve arbitrary command execution on the host machine. Similar injection risks exist for the{slug},{evidence_file}, and{schema_file}variables used in steps 2, 6, and 7.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and evaluate untrusted external data, which introduces a vulnerability to indirect prompt injection attacks.\n - Ingestion points: User-provided content (text or files), JSON evidence files, and custom schemas in SKILL.md.\n
- Boundary markers: The instructions do not define boundary markers or clear warnings to the agent to ignore instructions embedded within the evaluated content.\n
- Capability inventory: The skill has significant capabilities, including executing shell scripts and performing file system operations in
~/.claude-marketing/.\n - Sanitization: There is no mention of input validation, escaping, or sanitization of external data before it is processed by the evaluation scripts.
Recommendations
- AI detected serious security threats
Audit Metadata