jentic-api-improve
Fail
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: HIGHPROMPT_INJECTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill provides a 'Forbidden Shell Idioms' section that coaches the agent on avoiding specific shell patterns (such as command substitution and compound commands) for the purpose of evading the platform's static security analysis and bypassing permission prompts.
- [PRIVILEGE_ESCALATION]: The documentation encourages the use of '--permission-mode bypassPermissions' and '--dangerously-skip-permissions' to achieve autonomous execution. It also provides a configuration snippet for '.claude/settings.local.json' that grants broad wildcard-based tool permissions (e.g., 'Bash(python3 *)', 'Bash(npx *)').
- [DYNAMIC_EXECUTION]: The improvement workflow involves the agent writing Python scripts (e.g., 'edit-iter-N.py') to a hidden directory and then executing them via the shell, which allows for runtime execution of code generated by the LLM.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted OpenAPI documents from paths or URLs, creating a surface for injection attacks where malicious data could influence agent behavior.
- Ingestion points: OpenAPI source argument ($0) in 'SKILL.md'.
- Boundary markers: None identified.
- Capability inventory: Shell execution (python3, npx), file writing, and network retrieval.
- Sanitization: No evidence of input validation or content filtering for the spec data.
- [EXTERNAL_DOWNLOADS]: Fetches OpenAPI documents from remote URLs using Python's urllib module.
- [EXTERNAL_DOWNLOADS]: Downloads and executes vendor-provided CLI tools and Docker engines using npx and pipx.
Recommendations
- AI detected serious security threats
Audit Metadata