caveman-discover
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes the repository's source code, handlers, and configuration files as untrusted data to identify workflows. Malicious instructions embedded in these files (such as in comments or metadata) could potentially influence the agent's logic during the naming or verification phases.
- Ingestion points: Repository entry points, HTTP handlers, cron definitions, and scripts identified in Step 1 of SKILL.md.
- Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts within the files it analyzes.
- Capability inventory: The agent has the capability to modify repository files (Step 3) and execute shell commands (Step 4).
- Sanitization: No explicit sanitization of repository content is described prior to processing or interpolation.
- [COMMAND_EXECUTION]: Step 4 of the skill instructs the agent to execute existing tests, development scripts, or shell commands (like curl) defined within the repository to verify the changes. This capability grants the agent the power to execute arbitrary code provided by the repository's current state.
Audit Metadata