flash-platformio

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/pio_flasher.py executes the pio command (PlatformIO CLI) using subprocess.run(). It correctly passes arguments as a list, which prevents shell injection attacks by avoiding shell evaluation of input.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files and user-provided CLI arguments to determine flashing parameters.
  • Ingestion points: Reads configuration from platformio.ini within the user-specified project directory.
  • Boundary markers: None present.
  • Capability inventory: Executes the pio system command via subprocess.run in scripts/pio_flasher.py.
  • Sanitization: The script uses list-based command construction for subprocess.run, which provides inherent sanitization against shell injection risks from malformed input in project configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:40 AM