check
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill resolves ecosystem-specific commands (build, test, and lint) through a "resolution ladder" where configuration files located inside the repository being analyzed (e.g.,
.claude/ecosystems/dotnet.yaml) are authoritative. This allows a potentially malicious repository to define arbitrary shell commands that the skill will execute during verification tasks. - [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection via repository configuration files. Adversaries can control the commands the agent executes by modifying the
build-cmd,test-cmd, orcheck-cmdfields in the project's ecosystem YAML files. - Ingestion points:
.claude/ecosystems/*.yamlfiles in the audited repository (SKILL.md). - Boundary markers: Absent. The skill does not implement delimiters or safety instructions to distinguish between its own logic and instructions provided in the repository configuration.
- Capability inventory: Execution of arbitrary bash commands in the host environment (SKILL.md uses
shell: bash). - Sanitization: Absent. Resolved command strings from the untrusted configuration files are executed directly as shell commands without validation.
Audit Metadata