root-cause-coach
Fail
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's review process (Step 2) explicitly directs the agent to execute shell commands found in the 'Verification Shortcuts' section of an input report. This pattern represents a high-risk command injection vulnerability where untrusted data is treated as executable instructions via the Bash tool.
- [DATA_EXFILTRATION]: The instructions permit and encourage the use of tools like
curlandpsqlwithin a Bash environment. When combined with the execution of user-provided shortcuts, this facilitates the exfiltration of sensitive data, such as environment variables or local files, to external servers. - [PROMPT_INJECTION]: The skill lacks input validation and boundary markers for the investigation reports it consumes, making it highly susceptible to indirect prompt injection. The mandatory evidence chain analysis shows: 1. Ingestion point: 'VERIFICATION SHORTCUTS' section of reports; 2. Boundary markers: Absent; 3. Capability inventory: Bash, Read, curl, psql, kubectl; 4. Sanitization: Absent. The agent is instructed to follow instructions and execute commands embedded in the report data without proper safety controls.
Recommendations
- AI detected serious security threats
Audit Metadata