readme-first
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands and scripts discovered in the repository (e.g., "execute the primary happy path locally" in SKILL.md). This allows a malicious repository to trigger arbitrary command execution through its scripts or task runners.
- [REMOTE_CODE_EXECUTION]: The verification step involves running code from the repository environment, which acts as a remote code execution vector if the project contains malicious components.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting untrusted repository data.
- Ingestion points: Repository manifests, source code, and documentation (references/repo-inspection.md).
- Boundary markers: No delimiters are defined to separate untrusted content from agent instructions.
- Capability inventory: The skill allows shell execution and file access.
- Sanitization: No sanitization of commands or content extracted from the repository is specified.
Audit Metadata