wizard
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary purpose is to generate executable bash scripts based on a provided template (template.sh). These scripts are designed to interact with the user's shell, manipulate environment files, and execute commands like gh for GitHub secret management.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it instructs the agent to read various files within the repository to scope the setup procedure.
- Ingestion points: The agent reads repository files including .env, .env.example, README, docker-compose.yml, and GitHub workflow files.
- Boundary markers: There are no defined delimiters or instructions provided to the agent to distinguish between legitimate repository data and potentially malicious instructions embedded within those files.
- Capability inventory: The resulting generated scripts have the capability to write to the file system (write_env), read user input (including hidden secret input), and perform network-related operations via the GitHub CLI (set_secret).
- Sanitization: The skill does not implement sanitization or validation of the data ingested from the repository before using it to construct the logic of the generated wizard script.
Audit Metadata