caveman-setup
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands via
curlto verify the integration, potentially involving billable provider requests. - [DATA_EXFILTRATION]: Configuration changes route all LLM request data and API keys (via headers
x-cave-api-keyandx-cave-upstream-key) to an external gateway URL provided at runtime. - [CREDENTIALS_UNSAFE]: The skill manages sensitive API keys (
CAVE_API_KEY,PROVIDER_KEYS) and instructs the agent to store them in.envfiles. While it promotes the use of.gitignore, it requires the agent to handle and transmit these secrets. - [PROMPT_INJECTION]: The instructions include behavioral overrides such as "Send it now — do not pause to ask permission for it," which directs the agent to bypass standard user confirmation for billable or external network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where it ingests untrusted repository content during its search for callsites.
- Ingestion points: Reads
package.json,requirements.txt,pyproject.toml,go.mod, and repository source files (SKILL.md). - Boundary markers: None identified; no specific delimiters or instructions to ignore embedded commands in the scanned source files.
- Capability inventory: Shell command execution (
curl), file system read/write access (modifying.env,.gitignore, and source code), and network communication. - Sanitization: No evidence of sanitization or validation of the content read from repository files before processing.
Audit Metadata