complexa-sweep
Warn
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute shell commands using variables directly gathered from user dialogue, creating a potential command injection surface.\n
- Evidence: Step 4 in SKILL.md shows the construction of shell commands and loops (e.g.,
python script_utils/generate_inference_configs.pyandcomplexa design) using the $run_name and $pipeline_config_name variables.\n - Risk: Maliciously crafted user input containing shell metacharacters could lead to arbitrary command execution as the inputs are not explicitly sanitized in the instructions.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external CSV files and user-defined parameters without adequate boundary markers.\n
- Ingestion points: User-provided parameters (run_name, task_name) and external results_*.csv files parsed in Step 5.\n
- Boundary markers: Absent; no instructions are provided to the agent to treat this data as untrusted or to ignore embedded instructions.\n
- Capability inventory: The skill has Bash, Read, and Write capabilities, which could be exploited if the ingested data contains malicious instructions.\n
- Sanitization: Absent; the skill does not specify any filtering or validation of the CSV content before using it to generate summary reports and manifests.
Audit Metadata