pm-release
Warn
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Preamble section instructs the agent to execute a bash script located at a relative path outside the skill's directory structure (
../../check-update.sh). This allows the skill to execute arbitrary code that is not contained within the skill package itself. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests untrusted data from a user via the
AskUserQuestiontool and interpolates this data directly into a generated markdown file (上线执行方案.md). The template for this file contains multiple shell script blocks (e.g., git checkout, npm build, kubectl commands). Maliciously crafted user input (such as command separators) could result in the generation of documentation containing dangerous executable commands. - Ingestion points: User responses to
AskUserQuestionin Steps 1 through 5. - Boundary markers: None identified; input is directly mapped to placeholders like
[从步骤1提取]. - Capability inventory: Uses
Bash,Write, andReadtools. - Sanitization: No evidence of input validation, escaping, or sanitization before writing to the output document.
Audit Metadata