test-runner
Warn
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to sequentially run arbitrary shell commands provided via the 'Commands' input. It lacks any logic to validate, filter, or restrict these commands, allowing an attacker to execute any operation the agent has permissions for.
- [REMOTE_CODE_EXECUTION]: The ability to run arbitrary shell commands inherently allows for the download and execution of remote code using system tools like curl or wget. The skill does not implement any checks to prevent execution of unverified remote scripts.
- [DATA_EXFILTRATION]: Because the skill can execute arbitrary commands, it can be used to read sensitive files (such as .ssh keys or .env files) and transmit them to external servers if the input commands are malicious.
- [PROMPT_INJECTION]: The skill demonstrates a surface for indirect prompt injection.
- Ingestion points: The 'Commands' and 'WORKTREE' inputs provided in the SKILL.md execution flow.
- Boundary markers: None are present; the commands are passed directly to the shell without delimiters or instructions to ignore embedded malicious strings.
- Capability inventory: Full shell command execution via the system terminal.
- Sanitization: No input sanitization or command whitelisting is implemented.
Audit Metadata