codebase-architecture
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill recommends configuring 'Session start' hooks that automatically install missing dependencies. This creates an attack surface where a malicious repository could achieve remote code execution (RCE) on the agent's environment through package manager hooks (e.g.,
postinstallscripts) or supply chain contamination. - Ingestion points: Project dependency manifests (e.g.,
package.json) and lockfiles described inreferences/agent-runtime.md. - Boundary markers: Absent for the automated installation recommendation; the system relies on the assumption of a trusted workspace.
- Capability inventory: Dependency management tools (
npm,pnpm), git operations, and custom guardrail scripts (references/guardrail-tooling.md). - Sanitization: The instructions do not specify validation, pinning, or auditing of external packages before automated installation.
- [REMOTE_CODE_EXECUTION]: The documentation advises using remote execution patterns for development and migration tasks, such as
npx @next/codemod@canary middleware-to-proxy .andnpx depcruise --init. While these are standard practices in a professional development context, their automated execution by an agent represents a capability that must be carefully managed to prevent misuse or exploitation in untrusted environments.
Audit Metadata