to-spec
Warn
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell globbing to search for configuration files across the repository structure using the command
ls */skills/*-engineer/TRACKER.md .*/skills/*-engineer/TRACKER.md.- [COMMAND_EXECUTION]: The skill extracts and executes shell commands defined within a repository-controlled file (TRACKER.md). This allows for dynamic execution of arbitrary commands, which is a high-risk pattern if the source file is compromised or maliciously crafted.- [DATA_EXFILTRATION]: The skill aggregates conversation history, codebase architecture, and implementation decisions, and transmits this data to external issue trackers via remote CLI tools.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it relies on untrusted repository content to define its execution logic and context.\n - Ingestion points: Processes the
TRACKER.mdfile, repository source files (Glossary, ADRs), and the current conversation history.\n - Boundary markers: No explicit delimiters or safety instructions are provided to the agent to distinguish between the skill's instructions and potentially malicious content within the analyzed files.\n
- Capability inventory: The skill has the ability to explore the filesystem, read files, and execute shell commands derived from repository data.\n
- Sanitization: The skill does not implement validation or sanitization for the commands retrieved from the tracker configuration before they are executed.
Audit Metadata