fingerprint-failure-triage
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto retrieve and execute theliarjspackage from the NPM registry. This is a standard method for utilizing CLI tools and uses a version-pinned dependency. - [COMMAND_EXECUTION]: The skill procedure involves running shell commands through
Bashto invoke theliarjsscanner and its comparison features. - [SAFE]: The skill exhibits an indirect prompt injection surface by ingesting external JSON files. 1. Ingestion points:
scan.json,before.json, andafter.jsonfiles. 2. Boundary markers: No explicit delimiters or ignore instructions are present. 3. Capability inventory: IncludesBashfor command execution andReadfor file access. 4. Sanitization: No input validation or filtering is performed. However, the risk is negligible as the skill focuses on providing manual interpretative guidance.
Audit Metadata