scorecard
Warn
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes dynamic context injection (the
!command`` syntax) withinSKILL.mdto execute shell commands at the moment the skill is loaded by the agent. - [COMMAND_EXECUTION]: The injection command
node "${CLAUDE_SKILL_DIR}/../../dead-rules-audit.js" --renderexecutes a JavaScript file using Node.js. The path to this script is constructed dynamically using environment variables and points to a location two levels above the skill directory, meaning it executes code not provided within the skill package itself. - [COMMAND_EXECUTION]: While the skill includes
disable-model-invocation: trueto prevent the agent from calling further tools, the initial command execution happens automatically and has the same privileges as the user running the agent.
Audit Metadata