tlaplus
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
tla2tools.jarexecutable from the official TLA+ GitHub repository (github.com/tlaplus). - [REMOTE_CODE_EXECUTION]: Executes the downloaded
tla2tools.jarfile using thejava -jarcommand to run the model checker on TLA+ specifications. - [COMMAND_EXECUTION]: Constructs and executes shell commands such as
tlc SystemName.tlaandjava -jar tla2tools.jar SystemName.tlawhereSystemNameis a placeholder derived from user-provided content. This represents a potential surface for indirect prompt injection or command injection. - Ingestion points: User-provided system descriptions, design documents, and code extracts in Phase A1 and B1 (SKILL.md).
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the prompt templates.
- Capability inventory: The skill uses shell command execution (
tlc,java,brew,curl) to manage the verification workflow (SKILL.md Phase A3). - Sanitization: No validation or sanitization logic is provided to ensure that user-provided module names or file content do not contain shell metacharacters or malicious TLA+ directives.
Audit Metadata