modal
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: Documentation in references/images.md demonstrates mapping the sensitive local directory ~/.aws to a remote container, illustrating a vector for potential credential exposure.
- [DYNAMIC_EXECUTION]: The skill documents the use of run_commands and subprocess.Popen for executing code. A specific example in references/web-endpoints.md shows a web server serving the root directory (/), which could expose the container file system if deployed without protection.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the modal package and clones GitHub repositories such as modal-labs/agi during environment setup.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data via web endpoints and API calls, creating an attack surface for indirect prompt injection.
- Ingestion points: FastAPI endpoints and requests.get calls in documentation examples.
- Boundary markers: Examples do not include delimiters or instructions to ignore embedded instructions.
- Capability inventory: Use of run_commands, subprocess.Popen, and file system writes to persistent Volumes.
- Sanitization: Documentation examples do not demonstrate input validation or sanitization before processing external data.
Audit Metadata