hill-climb
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary functionality involves defining and executing arbitrary shell commands provided by the user or defined in domain playbooks for metric collection (MEASURE) and correctness verification (FLOOR). These commands are executed repeatedly throughout the optimization loop. Additionally, the skill utilizes several standard third-party profiling tools (such as py-spy, memray, and pprof) via the Bash tool to analyze system performance and identify bottlenecks.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating an attack surface where instructions embedded in outputs could influence agent behavior.\n
- Ingestion points: Metric outputs from measurement commands, status results from floor commands, profiler results, and CI data fetched from the GitHub CLI (gh) (documented in SKILL.md and references/domain-playbooks.md).\n
- Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore potential commands embedded in the output of measurement or profiling tools.\n
- Capability inventory: The agent has access to powerful tools including Bash, Write, Edit, and the ability to invoke other Skills and Agents, which could be leveraged if an injection occurred.\n
- Sanitization: There is no evidence of filtering or validation of the external tool outputs before they are processed by the agent.
Audit Metadata