gsd-path-forensics
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructions in SKILL.md and references/runtime-selection.md direct the agent to execute a Python script (status_runtime.py) located within the target project's .gsd-path directory. This mechanism allows a repository to execute arbitrary code in the agent's environment by providing a malicious runtime script.
- [COMMAND_EXECUTION]: The scripts/loop_run.py utility contains a run_shell function that executes arbitrary shell commands extracted from the verify field of LOOP.md files found in the repository. An attacker can craft a malicious LOOP.md to achieve command execution when the agent processes the loop specification.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from untrusted files such as LOOP.md, DIALOGUE.md, and ANSWERS.md. These files are parsed for instructions that drive agent behavior, such as determining retry commands or resolving model policies, creating a surface for indirect prompt injection.
- [DYNAMIC_EXECUTION]: Several scripts, including discussion_records.py, pipeline_diagnose.py, and path_config.py, dynamically manipulate sys.path and use importlib.import_module to load and execute helper scripts from project-local paths or computed runtime directories, allowing for the execution of unverified code.
Audit Metadata