ai-tools
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a listening loop that ingests data from an external web application via a script, creating a significant attack surface for indirect prompt injection.
- Ingestion points: Data is read via the
wait-ai-tools-result.shscript, which monitors a JSON result file (/tmp/ai-tools-result.json) populated by the web app. - Boundary markers: The skill body contains no instructions to ignore or delimit embedded commands within the ingested JSON.
- Capability inventory: The agent can execute shell scripts, write/edit files on the filesystem, and invoke other specialized skills based on the received payload.
- Sanitization: The skill instructions explicitly state to pass payloads such as
additionalContextverbatim to other skills, with no evidence of validation or escaping. - [COMMAND_EXECUTION]: The skill performs shell execution using user-supplied input:
bash "${CLAUDE_SKILL_DIR}/../../scripts/ensure-ai-tools-app.sh" "<route or '/'>". If the$ARGUMENTSused to derive the route contains shell metacharacters, it could lead to arbitrary command execution. - [COMMAND_EXECUTION]: The skill executes vendor-provided management scripts (
ensure-ai-tools-app.shandwait-ai-tools-result.sh) to control the application container and poll for updates. - [COMMAND_EXECUTION]: The skill performs direct file system manipulation by truncating a temporary file using the shell colon operator:
: > /tmp/ai-tools-result.json.
Audit Metadata