refine-live
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlcommands to interact with a local relay service athttp://localhost:7331for long-polling jobs and posting execution results. - [INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface where untrusted data retrieved from the network relay could influence critical file system operations.
- Ingestion points: Job data containing CSS selectors, labels, and property metadata is fetched from
http://localhost:7331/jobs/next(SKILL.md). - Boundary markers: No explicit delimiters or instructions are used to separate external job data from the agent's internal reasoning logic, which increases the risk of the agent following instructions embedded in the job payload.
- Capability inventory: The skill is capable of reading project source files during 'scan' jobs and writing modifications to those files during 'apply' jobs. It also utilizes network communication via
curl. - Sanitization: There is no evidence of validation or sanitization of the relay's response before the data is used to identify and modify source code.
Audit Metadata