flash-platformio
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/pio_flasher.pyexecutes thepiocommand (PlatformIO CLI) usingsubprocess.run(). It correctly passes arguments as a list, which prevents shell injection attacks by avoiding shell evaluation of input. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files and user-provided CLI arguments to determine flashing parameters.
- Ingestion points: Reads configuration from
platformio.iniwithin the user-specified project directory. - Boundary markers: None present.
- Capability inventory: Executes the
piosystem command viasubprocess.runinscripts/pio_flasher.py. - Sanitization: The script uses list-based command construction for
subprocess.run, which provides inherent sanitization against shell injection risks from malformed input in project configuration files.
Audit Metadata