promotion-gate
Warn
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local script at
~/.claude/evolution/bin/evolve-promote.shusing thebashshell, incorporating a user-controlled<id>parameter. - Evidence: The instructions describe running
bash ~/.claude/evolution/bin/evolve-promote.sh --check <id>andbash ~/.claude/evolution/bin/evolve-promote.sh <id>where<id>originates from the user command/evolution promote <id>. - Risk: The lack of explicit sanitization for the
<id>variable allows for potential command injection. A malicious user could provide an identifier containing shell metacharacters (such as;,|, or&&) to execute arbitrary commands on the host system.
Audit Metadata