aio-ade-cli
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary purpose is to execute commands via the
aio-adebinary (or variations likeaio-ade-dev). It allows the agent to control worktrees, terminals, and repositories through a local shell environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from worktree comments, terminal outputs, and an embedded browser. This creates an attack surface where malicious content could be interpreted by the agent as instructions.
- Ingestion points: AIO-ADE terminal buffers, worktree comment metadata, and content from the embedded browser referenced in
SKILL.md. - Boundary markers: None identified; the instructions do not specify using delimiters or specific 'ignore' directives when processing external content.
- Capability inventory: Execution of subcommands via the
aio-adebinary, including browser control, terminal interaction, and automation triggers. - Sanitization: Not mentioned; the skill does not explicitly instruct the agent to sanitize or escape external data before interpreting it.
- [DYNAMIC_EXECUTION]: The skill utilizes a 'discovery stub' pattern where the actual usage guide is fetched at runtime by executing
AIO_ADE skills get aio-ade-cli. This dynamic retrieval of instructions means the full operational logic is not contained within the staticSKILL.mdfile, preventing a complete static audit of the agent's instructions.
Audit Metadata