aif-rules-check
Warn
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to load and follow instructions from external files within the project repository. Specifically, it reads .ai-factory/skill-context/aif-rules-check/SKILL.md and treats its content as mandatory overrides that win over the skill's own logic. This creates a surface for indirect prompt injection. * Ingestion points: .ai-factory/skill-context/aif-rules-check/SKILL.md, .ai-factory/config.yaml, and various rule files. * Boundary markers: None mentioned. * Capability inventory: Bash(git *), Read, Glob, and Grep. * Sanitization: None mentioned.
- [COMMAND_EXECUTION]: The skill dynamically constructs shell commands using user-provided arguments and configuration values. In Step 2.1, a user-supplied git ref is passed directly to git rev-parse --verify. If the environment's tool restriction for Bash(git *) does not prevent command chaining characters (like semicolon, double-ampersand, or pipe), this could allow an attacker to execute arbitrary commands by supplying a malicious git reference. Similarly, the git.base_branch value from .ai-factory/config.yaml is used in git diff commands without validation.
Audit Metadata