live-broadcast
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
cyeam tvcommand with arguments derived directly from user input (e.g.,--team,--league,--days). - [PROMPT_INJECTION]: Indirect Prompt Injection Surface:
- Ingestion points: User queries containing team names, leagues, and date ranges are used to construct CLI commands (SKILL.md).
- Boundary markers: Absent. There are no instructions for the agent to validate or sanitize user input before interpolation.
- Capability inventory: The skill has the capability to execute shell commands via the
cyeamutility (SKILL.md). - Sanitization: Absent. The instructions do not mention escaping shell metacharacters (e.g.,
;,|,&) which could lead to command injection if the underlying platform doesn't handle them safely.
Audit Metadata