opencode-file-toolkit
Fail
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute installation scripts for the
uvpackage manager andDenoruntime using piped shell execution (| shand| iex). These scripts are fetched fromastral.shanddeno.land. - [COMMAND_EXECUTION]: The instructions command the agent to run various system-level tools including
git clone,powershell,winget, anduvto set up local environments and install system dependencies. - [EXTERNAL_DOWNLOADS]: Fetches configuration files and source code from the author's GitHub repository (
mathruffian-dot/ai-agent-ep03) and downloads tools from official service domains. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from sources like Word, Excel, PDF files, and YouTube links, combined with capabilities to execute shell commands and modify the file system.
- Ingestion points: Reads content from external Word, Excel, PowerPoint, PDF, and image files provided by the user.
- Boundary markers: The skill includes a 'Seven Rules' section that instructs the agent to work only within the project folder and avoid global system changes.
- Capability inventory: Provides access to powerful CLI tools like
yt-dlp,ffmpeg, anduvfor downloading content and managing environments. - Sanitization: No specific content sanitization or instruction-bypass filtering is mentioned for the processed files.
- [PROMPT_INJECTION]: Contains a section titled 'Seven Rules for the Agent' which overrides default behavior by directing the agent to ignore certain research steps and strictly adhere to specific directory and installation constraints.
- [DATA_EXFILTRATION]: Uses the
edge-ttstool, which transmits user-provided text to a cloud-based service for speech generation. While this is the tool's primary purpose, it involves sending data to an external API.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh, https://deno.land/install.sh - DO NOT USE without thorough review
Audit Metadata