validate-v2
Warn
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run "targeted tests", "build", "lint", and "repro commands" as part of the validation pipeline (§3 and references/artifact-checks.md). These commands often rely on scripts defined within the repository being validated (e.g., in a package.json or Makefile), effectively allowing the repository to execute arbitrary code on the runner when the skill is invoked.
- [PROMPT_INJECTION]: As an artifact validator, the skill ingests untrusted content including code comments, markdown plans, and specification documents. This creates an indirect prompt injection surface where a malicious artifact could include instructions to manipulate the validation verdict, suppress critical findings, or redirect the agent's actions.
- [DATA_EXFILTRATION]: The "Security & Privacy" and "Operations" validation lenses (§5) explicitly direct the agent to access sensitive information such as "auth, permissions, secrets", "env vars", "CI config", and "deployment flags". This capability allows the agent to read and potentially report sensitive environmental data or credentials during the validation process.
- [COMMAND_EXECUTION]: The skill's logic for resolving targets based on user-provided arguments ($ARGUMENTS) and file paths poses a risk if these inputs are interpolated into shell commands (e.g., for file search or git diffs) without strict sanitization, potentially leading to command injection.
Audit Metadata