theory-vs-reality
Fail
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's 'Stage 0' allows for the execution of arbitrary shell commands through a 'retrieval recipe' (e.g., 'run aaa ralph subtasks list'). If the input source is untrusted, this can be exploited to execute malicious code on the host system.
- [COMMAND_EXECUTION]: Stage 4 automatically executes shell commands ('open' or 'xdg-open') to open the generated HTML artifact, which could be leveraged if the output filename is manipulated.
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection as it processes untrusted plan data and repository source code to drive its verification logic without any sanitization or boundary markers.
- Ingestion points: User-provided plan text and files (Stage 0), and repository source code (Stage 2).
- Boundary markers: None. There are no instructions for subagents to distinguish between their instructions and the data being analyzed.
- Capability inventory: The agent has the ability to execute shell commands, read/write files, and spawn subagents.
- Sanitization: None. External data is directly interpolated into prompts and the final HTML output.
- [COMMAND_EXECUTION]: The skill generates an HTML file with inline JavaScript based on external data. This creates a risk of Cross-Site Scripting (XSS) if malicious content from the audited plan or code is rendered into the HTML artifact and executed in the user's browser context.
Recommendations
- AI detected serious security threats
Audit Metadata