homework
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes shell commands via the
cyeam trelloCLI tool to perform Trello operations such as authentication (login), checking status (status), listing resources (boards,lists,cards), and creating new tasks (card create). This tool appears to be a vendor-specific resource associated with the skill's author. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (homework task names and descriptions) and interpolates them into commands executed by the agent.
- Ingestion points: Homework task content and specific requirements provided by the user in the
SKILL.mdworkflow. - Boundary markers: The skill uses CLI flags (
--name,--desc) and double quotes to delimit user content within the shell command strings. - Capability inventory: The skill uses the
cyeam trelloCLI which has network access (to Trello API) and the ability to read existing board data. - Sanitization: No explicit sanitization or filtering logic is defined for the user-provided text beyond standard shell argument passing.
Audit Metadata