aep-gen-eval
Fail
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: HIGHPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill's evaluation protocol instructs the agent to execute commands that bypass platform security controls. It explicitly mentions and provides commands to use flags such as '--dangerously-skip-permissions' and '--dangerously-bypass-approvals-and-sandbox' when spawning sub-agents in 'references/eval-protocol.md', which effectively removes security sandboxing and permission checks.\n- [COMMAND_EXECUTION]: The execution protocol relies on raw shell commands using 'tmux' to manage sub-processes. This method of process control (split-window, send-keys) allows for the execution of arbitrary logic and increases the risk of command injection if parameters are influenced by untrusted data derived from the artifacts being evaluated.\n- [INDIRECT_PROMPT_INJECTION]: The skill architecture is built to ingest and process untrusted artifacts, creating a vulnerability to indirect prompt injection where malicious instructions in artifacts could influence agent behavior.\n
- Ingestion points: The '{artifact_content}' and '{eval_request_file}' placeholders in the agent prompts defined in 'references/agent-contracts.md'.\n
- Boundary markers: Templates use markdown headers for structure, but there are no robust delimiters or specific 'ignore instructions' escape sequences to isolate untrusted content from the agent's core logic.\n
- Capability inventory: The skill utilizes shell execution (tmux) and file system writes to manage the evaluation signal files.\n
- Sanitization: There is no mechanical sanitization or validation of the ingested artifact content performed before it is passed to the LLM.
Recommendations
- AI detected serious security threats
Audit Metadata