tasks
Warn
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The framework includes logic to automatically bootstrap its own environment by installing Python dependencies at runtime.
_cli/cli/dependencies.pyand_shared/tools/yaml_compat.pyusesubprocess.runto callpip installfor required libraries.- [EXTERNAL_DOWNLOADS]: The skill fetches software packages and system utilities from external repositories.
_shared/tools/dependency-utils.shcontains routines to install system packages usingbrew,apt-get,apk,dnf, oryumbased on the detected OS.- [COMMAND_EXECUTION]: The core functionality of the skill relies on executing system-level commands and external binaries.
_cli/cli/orchestrator/agent_caller.pyexecutes theclaudeCLI to invoke sub-agents, passing them generated prompts and controlling their tool access._scripts/hooks/workflow_hooks.pyruns project-specific test suites usingpnpm testorpytestvia subprocess calls._shared/tools/dependency-utils.shusessudoon Linux distributions to execute package management commands with root privileges.- [PROMPT_INJECTION]: The skill creates a significant surface for Indirect Prompt Injection due to its data ingestion and tool capability mix.
- It ingests untrusted data from the web (via
WebFetch) and from local codebase files (viaRead). - This data is processed by agents that possess powerful tools including
Bash(arbitrary command execution) andWrite(filesystem modification), creating a risk that malicious instructions in analyzed data could influence the agent's actions.
Audit Metadata