commands-creator
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill documents the
!commandsyntax (e.g.,!git status,!npm testin SKILL.md and references/advanced-features.md), which executes shell commands when a command file is loaded or invoked. This feature provides a surface for silent code execution if malicious command files are introduced to a project environment.\n- [COMMAND_EXECUTION]: The guide includes multiple examples where user-provided arguments are interpolated directly into shell commands, creating a potential command injection vulnerability. Evidence includes!git commit -m \"$ARGUMENTS\"in references/syntax-and-arguments.md and!git checkout -b feature/$1in references/examples.md. An attacker providing an argument containing command separators could trigger arbitrary command execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes an attack surface where untrusted user input from slash command arguments is incorporated into tool calls.\n - Ingestion points: Slash command argument placeholders
$1,$2, and$ARGUMENTSdocumented in references/syntax-and-arguments.md.\n - Capability inventory: Documents the use of the Bash tool and command-scoped lifecycle hooks (
PreToolUse,PostToolUse,Stop) in references/advanced-features.md.\n - Sanitization: The provided examples do not include logic for sanitizing or escaping arguments before they are used in shell commands.\n
- Boundary markers: The provided examples lack delimiters or explicit instructions to isolate user-supplied arguments from the command logic.
Audit Metadata