agent-self-evaluation-patterns

Warn

Audited by Gen Agent Trust Hub on Apr 8, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The verifyApiExists function in SKILL.md uses require(modulePath) where modulePath is a parameter. This allows for the dynamic loading and execution of arbitrary JavaScript modules. If the path is derived from untrusted LLM-generated content, it could be exploited to load and run malicious local files.
  • [COMMAND_EXECUTION]: The use of require() on a dynamic path constitutes a code execution capability within the agent's environment.
  • [PROMPT_INJECTION]: The skill is designed to process and evaluate untrusted LLM output across several functions (judgeAnswer, verifyClaims, reflectAndRevise) without implementing boundary markers or sanitization, creating a surface for indirect prompt injection.
  • Ingestion points: The answer and question parameters in the evaluation functions in SKILL.md serve as entry points for potentially malicious data.
  • Boundary markers: Absent; the instructions do not use delimiters or clear separation to prevent the agent from being influenced by commands embedded within the text it is evaluating.
  • Capability inventory: The require(modulePath) call in SKILL.md provides a mechanism for executing code based on the data being processed.
  • Sanitization: Absent; the skill lacks validation or filtering of the content before it is passed to logic that performs dynamic loading or multi-step reasoning.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 8, 2026, 08:24 AM
Security Audit — agent-trust-hub — agent-self-evaluation-patterns