explainer
Warn
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to build shell commands by interpolating user-provided inputs, such as
{topic}and{url}, directly into CLI arguments (e.g.,--query "{topic}"). The absence of requirements for escaping or sanitizing these variables creates a significant risk for shell command injection. - [REMOTE_CODE_EXECUTION]: The skill mandates that if the required CLI tool is missing, the agent should "auto-install and auto-login" without manual intervention. This encourages the agent to download and execute arbitrary installation scripts from external sources, which is a high-risk behavior for software supply chain security.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user topics and external reference URLs. These inputs are interpolated into shell commands and used for content generation without boundary markers or sanitization instructions, creating a surface for indirect prompt injection attacks.
- [DATA_EXPOSURE]: The skill is configured to read from and write to the user's home directory (e.g.,
~/.listenhub/explainer/config.json). While this is used for persistence of tool settings, it involves file system access beyond the immediate working directory.
Audit Metadata