ai-automation-workflows
Fail
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides detailed instructions and code examples for establishing persistence by modifying the system's crontab. It specifically guides the creation of scheduled tasks (e.g., daily_content.sh) to maintain periodic execution across sessions using the 'crontab -e' command.\n- [PROMPT_INJECTION]: The skill documents a data processing workflow (data_processing.sh) that creates an indirect prompt injection surface by ingesting local text files and interpolating their raw contents directly into LLM prompts using '$(cat $file)'.\n
- Ingestion points: Reads all .txt files from a local directory (SKILL.md).\n
- Boundary markers: No delimiters or instructions to ignore embedded content are implemented in the example script.\n
- Capability inventory: The skill utilizes the 'belt' CLI tool to perform remote inference, providing a path for injected instructions to influence downstream actions.\n
- Sanitization: The script does not perform any validation, escaping, or filtering of the file content before interpolation.\n- [DATA_EXFILTRATION]: The skill includes an error monitoring template (monitored_workflow.sh) that demonstrates a data exfiltration pattern by using 'curl' to transmit command output and execution errors to a user-defined external webhook (https://your-webhook.com/alert).\n- [EXTERNAL_DOWNLOADS]: The skill references external installation instructions and scripts hosted on a third-party GitHub repository (https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md) for the setup of the 'belt' CLI tool.
Recommendations
- AI detected serious security threats
Audit Metadata