om-prepare-test-env
Warn
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell scripts (.sh or .ps1) that it either discovers in the repository or generates itself during the setup process.
- [REMOTE_CODE_EXECUTION]: The skill generates executable scripts based on project discovery (Phase 2) and subsequently executes them (Phase 1). It also uses dynamic code execution via python -c and node -e for port discovery tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill reads untrusted data from the repository to shape its behavior and generate executable code.
- Ingestion points: The skill reads README, package.json, agent instruction files (AGENTS.md, CLAUDE.md), and CI workflows to discover run commands.
- Boundary markers: The agentic-setup reference defines an Untrusted content boundary instructing the agent to treat repo content as data and ignore directives like 'ignore previous instructions'.
- Capability inventory: The skill has the ability to write scripts to the filesystem and execute them via shell or PowerShell, and can perform Docker operations.
- Sanitization: Instructions specify validation of externally-sourced values using regex and require quoting before interpolation into shell commands.
- [PROMPT_INJECTION]: The skill is instructed in references/agentic-setup.md to load and prioritize repo-local extensions (.ai/skills/om-prepare-test-env/SKILL.md), which could allow a malicious repository to override agent behavior.
- [PRIVILEGE_ESCALATION]: The skill utilizes powershell -ExecutionPolicy Bypass to run generated scripts, effectively bypassing local security policies designed to restrict script execution.
- [DYNAMIC_EXECUTION]: The skill generates shell scripts at runtime based on repository content and uses one-line python and node snippets to perform environment checks.
Audit Metadata