check-in-later
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill dynamically loads and executes instruction sets from paths provided in the
nextinput parameter. The instructions explicitly tell the agent to "Keep that path as given," allowing for the execution of skills from arbitrary filesystem locations. If thenextpath is influenced by untrusted input, it allows for arbitrary skill execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data to determine its next actions, creating a vulnerability surface. 1. Ingestion points: The
next,reread, andrecordparameters inSKILL.md. 2. Boundary markers: Absent; there are no instructions to ignore embedded commands in the loaded files. 3. Capability inventory: File read, file write, and skill execution. 4. Sanitization: Absent; no path validation or content filtering is performed on external inputs. - [COMMAND_EXECUTION]: The agent may execute arbitrary instructions or system commands if the file path provided in the
nextparameter points to a malicious skill file.
Audit Metadata