muse-feedback
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local CLI tool
/opt/hatch/bin/feature-requestto draft and file reports. The agent is instructed to execute shell commands with arguments derived from user input, specifically the--summaryand--contextflags. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user feedback and interpolates it into shell commands, creating a potential injection surface.
- Ingestion points: User-provided feedback and feature requests entered during the conversation (SKILL.md).
- Boundary markers: The instructions attempt to mitigate shell injection by mandating single quotes around arguments (e.g.,
--summary '...') to prevent bash variable expansion, though this does not fully prevent injection if the input contains single quotes. - Capability inventory: Execution of shell commands via the
feature-requestCLI (SKILL.md). - Sanitization: The skill instructs the agent to manually remove PII (names, contact details) from the summary, but lacks a systematic requirement for escaping shell metacharacters within the user-provided strings.
Audit Metadata