agent-self-evaluation-patterns
Warn
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
verifyApiExistsfunction inSKILL.mdusesrequire(modulePath)wheremodulePathis a parameter. This allows for the dynamic loading and execution of arbitrary JavaScript modules. If the path is derived from untrusted LLM-generated content, it could be exploited to load and run malicious local files. - [COMMAND_EXECUTION]: The use of
require()on a dynamic path constitutes a code execution capability within the agent's environment. - [PROMPT_INJECTION]: The skill is designed to process and evaluate untrusted LLM output across several functions (
judgeAnswer,verifyClaims,reflectAndRevise) without implementing boundary markers or sanitization, creating a surface for indirect prompt injection. - Ingestion points: The
answerandquestionparameters in the evaluation functions inSKILL.mdserve as entry points for potentially malicious data. - Boundary markers: Absent; the instructions do not use delimiters or clear separation to prevent the agent from being influenced by commands embedded within the text it is evaluating.
- Capability inventory: The
require(modulePath)call inSKILL.mdprovides a mechanism for executing code based on the data being processed. - Sanitization: Absent; the skill lacks validation or filtering of the content before it is passed to logic that performs dynamic loading or multi-step reasoning.
Audit Metadata