consulting-an-oracle
Fail
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
test-pressure-3.mdcontains hardcoded sensitive information including a GitHub API token and database credentials. - Evidence: Hardcoded GitHub token
ghp_aB12cD34eF56gH78iJ90kL12mN34oP56qR78. - Evidence: Hardcoded Redis password
hunter2dev. - Evidence: Hardcoded PostgreSQL connection string with credentials
postgres://app:appdev@localhost:5432/app_dev. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading untrusted local project files and concatenating them into a new prompt file, which could allow malicious instructions in those files to influence the downstream AI model.
- Ingestion points:
SKILL.mdStep 4 reads project files, including failing files and their collaborators. - Boundary markers: Content is placed inside Markdown blocks in
template.md, but there are no explicit instructions for the oracle model to ignore instructions found within the attached code. - Capability inventory: The skill performs extensive file system reads and writes to generate the oracle prompt.
- Sanitization: While Step 5 redacts credentials, it does not sanitize the content for malicious prompt injection instructions.
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to perform environment reconnaissance.
- Evidence: Step 1 in
SKILL.mdexecutesruby --version,bundle --version,grep,cat, andlsto identify the project's technology stack.
Recommendations
- AI detected serious security threats
Audit Metadata